Giter Club home page Giter Club logo

interactive-broadcast-api's Introduction

OpenTok Interactive Broadcasting Solution Backend

Tokbox is now known as Vonage

Important note: We are archiving this prject. Contact Vonage support if you have questions.

The OpenTok Interactive Broadcast Solution Backend is based on Apache Hadoop and uses Firebase as the underlying storage.

This document describes how to create an OpenTok Interactive Broadcast Solution Backend Server.

Use the backend server to manages interactive broadcast events. Use it in conjunction with the Interactive Broadcast Solution client apps for the web, iOS, and Android.

Installing dependencies

Clone the repository and cd to the project directory.

git clone https://github.com/opentok/interactive-broadcast-api
cd interactive-broadcast-api

Install yarn:

npm install -g yarn

Install dependencies:

yarn

Configuration settings

Set environment (vars):

cp .env.example .env

Edit the .env file:

NODE_ENV=development
PORT=3001
JWT_SECRET=0a6b944d-d2fb-46fc-a85e-0295c986cd9f
INTERACTIVE_STREAM_LIMIT=2
BUCKET_URL=INSERT_HERE

Replace these values with the following:

  • NODE_ENV -- Your Node environment setting, either development or production.

  • PORT -- The port for the backend service should use.

  • JWT_SECRET -- The backend uses this string to generate JWT tokens used to validate all client requests.

  • INTERACTIVE_STREAM_LIMIT -- The maximum number of active fans to allow in an event. After this limit is reached, a fan connecting to the event will see the HLS broadcast of the event, and the fan will not be able to join the event interactively by publishing their audio-video stream. (Note that Safari users will always receive the HLS broadcast, since OpenTok is not currently supported in Safari.)

  • BUCKET_URL -- The URL of your Amazon S3 bucket, such as https//s3.amazonaws.com/yourBucketName.

Add you Firebase credentials to the /config/config.js file.

const config = {
  env: envVars.NODE_ENV,
  port: envVars.PORT,
  jwtSecret: envVars.JWT_SECRET,
  fireBaseAuthDomain: 'your-app-id.firebaseapp.com',
  firebaseDatabaseURL: 'https://your-app-id.firebaseio.com',
  firebaseProjectId: 'your-app-id',
  firebaseStorageBucket: 'your-app-id.appspot.comx',
  interactiveStreamLimit: envVars.INTERACTIVE_STREAM_LIMIT || Infinity,
};

Set the following values:

  • fireBaseAuthDomain -- Your Firebase authentication domain. This will look like 'your-app-id.firebaseapp.com'.

  • firebaseDatabaseURL -- Your Firebase database URL. This will look like 'https://your-app-id.firebaseio.com'.

  • firebaseProjectId -- Your Firebase project ID. This will look like 'your-app-id'.

  • firebaseStorageBucket -- Your Firebase storage bucket. This will look like 'your-app-id.appspot.com'.

Running the app

Start the server:

yarn start

Deployment

# compile to ES5
1. yarn build

# upload dist/ to your server
2. scp -rp dist/ user@dest:/path

# install production dependencies only
3. yarn --production

# Use any process manager to start your services
4. pm2 start dist/index.js

Exploring the Code

This section details the inner workings of OpenTok Interactive Broadcasting Solution Backend.

Services

The Interactive Broadcasting Solution Backend consists of various services:

admins.js

Manage operation over administrator users. It implements the following methods:

getAdmins     => Gets the list of admins
getAdmin      => Gets a particular Admin from firebase
createAdmin   => Creates an admin
createUser    => Creates an user in firebase-admin
updateUser    => Updates an user in firebase-admin
updateAdmin   => Updates an admin
deleteAdmin   => Deletes an admin in firebase-admin
deleteUser    => Deletes an user in firebase-admin

auth.js

Handles authentication using the following methods:

login           => Returns jwt token if valid username and password is provided for an admin or producer.
loginFan        => Returns jwt token if valid username and password is provided for a fan user.
loginHost       => Returns jwt token if valid username and password is provided for a host user.
loginCelebrity  => Returns jwt token if valid username and password is provided for a celebrity user
updateUser      => Updates an user in firebase-admin
updateAdmin     => Updates an admin
deleteAdmin     => Deletes an admin in firebase-admin
deleteUser      => Deletes an user in firebase-admin

broadcast.js

Manages the broadcast session, implements these methods:

getBroadcastData  => Returns data required for the client to connect to the broadcast (CDN) feed.
endBroadcast      => End the broadcast.
eventGoLive       => Puts the event live.

dbProperties.js

Exports the following Props.

adminProps

Data of the admin users

const adminProps = [
  'id',
  'displayName',
  'otApiKey',
  'otSecret',
  'superAdmin',
  'httpSupport',
  'email',
  'hls',
  'createdAt',
  'updatedAt'
];
userProps

Contains common data of all the users disregarding the role:

const userProps = ['displayName',
  'email',
  'password'
];
eventProps

These Props represent private data for the events.

const eventProps = [
  'id',
  'name',
  'startImage',
  'endImage',
  'fanUrl',
  'celebrityUrl',
  'hostUrl',
  'archiveEvent',
  'status',
  'dateTimeStart',
  'dateTimeEnd',
  'sessionId',
  'stageSessionId',
  'archiveUrl',
  'archiveId',
  'redirectUrl',
  'uncomposed',
  'showStartedAt',
  'showEndedAt',
  'adminId',
  'rtmpUrl',
  'createdAt',
  'updatedAt'
];
eventPublicProps

Contains data publicly visible from the events

const eventPublicProps = [
  'id',
  'adminId',
  'name',
  'startImage',
  'endImage',
  'fanUrl',
  'celebrityUrl',
  'hostUrl',
  'status',
  'dateTimeStart',
  'dateTimeEnd'
];
TS

The current timestamp.

timestampCreate

The creation timestamp of an event.

timestampUpdate

The last timestamp at which an event was updated.

eventStatuses

Array containing the possible status values for an event.

const eventStatuses = {
  NOT_STARTED: 'notStarted',
  PRESHOW: 'preshow',
  LIVE: 'live',
  CLOSED: 'closed'
};

event.js

Handles interaction with the events database using the following methods.

getEvents              =>  Get the list of events by admin
create                 =>  Save an event
update                 =>  Updates an event
deleteEvent            =>  Deletes an event
getEvent               =>  Get a particular Event
deleteEventsByAdminId  =>  Delete events by AdminId
getEventByKey          =>  Get a particular Event by primary key <slug, adminId>
changeStatus           =>  Change status of an event.
startArchive           =>  Starts archive
stopArchive            =>  Stops archive
createTokenProducer    =>  Create the tokens for the producer, and returns also the event data
createTokenHostCeleb   =>  Create the token for the host or celebrity, and returns also the event data
getEventBySessionId    =>  Get a particular Event by sessionId
createTokensFan        =>  Create the tokens for the fan, and returns also the event data
getMostRecentEvent     =>  Get the last event that is `live` or `preshow`
createTokenByUserType  =>  Get credentials for the last event that is `live` or `preshow`
getEventsByAdmin       =>  Get the list of events by admin for mobile apps without token

firebase.js

Initializes the app with a service account, granting admin privileges.

firebase.initializeApp({
  databaseURL: config.firebaseDatabaseURL,
  credential: firebase.credential.cert(serviceAccountCredentials)
});

It implements the verifyIdToken method that verifies an IdToken with firebase

const verifyIdToken = async (idToken) => {
  try {
    const decodedToken = await firebase.auth().verifyIdToken(idToken);
    return decodedToken.user_id;
  } catch (error) {
    return null;
  }
};

and also exposes a file method which utilizes the google cloud storage API to interact with files in firebase storage.

opentok.js

This service is in charge of managing OpenTok tokens and archiving using the following methods:

createSession => Returns a new OpenTok session, along with the corresponding OpenTok API key.
createToken   => Creates an OpenTok token
startArchive  => Starts the archiving and returns the archiveId
stopArchive   => Starts the archiving and returns the archiveId
otRoles       => Array containing the user roles
getAdmins     => Gets the list of admins
getAdmin      => Gets a particular Admin from firebase
createAdmin   => Creates an admin
createUser    => Creates an user in firebase-admin
updateUser    => Updates an user in firebase-admin
updateAdmin   => Updates an admin
deleteAdmin   => Deletes an admin in firebase-admin
deleteUser    => Deletes an user in firebase-admin

Middleware

The Interactive Broadcasting Solution Backend uses the validation.js middleware to convert the OpenTok data to a json format imeplementing the following API methods:

validateApiKey  => Checks if the `APIKey` and `APISecret` are valid.
validateEvent   => Validates if the event already exsists by comparing the event id with the existing events
checkAdmin      => Check the role of the user is Admin, if not returns an authentication error.
checkFan        => Similar to `checkAdmin`, checks if the role of an user is Fan
checkCelebHost  => Similar to `checkAdmin`, checks if the role of an user is Celebrity or Host

Development and Contributing

Interested in contributing? We ❤️ pull requests! See the Contribution guidelines.

Getting Help

We love to hear from you so if you have questions, comments or find a bug in the project, let us know! You can either:

Further Reading

interactive-broadcast-api's People

Contributors

adrice727 avatar behaze avatar dalanir avatar ggoldens avatar greenkeeperio-bot avatar hananbo avatar jeffswartz avatar kunalkapadia avatar maxsbelt avatar michaeljolley avatar msach22 avatar osahner avatar panoramicrum avatar rafaelhz avatar readmecritic avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

interactive-broadcast-api's Issues

request-2.81.0.tgz: 7 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - request-2.81.0.tgz

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (request version) Remediation Available
CVE-2021-3918 High 9.8 json-schema-0.2.3.tgz Transitive 2.82.0
CVE-2018-16492 High 9.8 extend-3.0.1.tgz Transitive 2.82.0
CVE-2018-1000620 High 9.8 cryptiles-2.0.5.tgz Transitive 2.84.0
CVE-2018-3728 High 8.8 hoek-2.16.3.tgz Transitive 2.82.0
CVE-2022-24999 High 7.5 qs-6.4.0.tgz Transitive 2.82.0
CVE-2022-29167 High 7.5 hawk-3.1.3.tgz Transitive N/A*
CVE-2020-15366 Medium 5.6 ajv-4.11.8.tgz Transitive 2.88.0

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

CVE-2021-3918

Vulnerable Library - json-schema-0.2.3.tgz

JSON Schema validation and specifications

Library home page: https://registry.npmjs.org/json-schema/-/json-schema-0.2.3.tgz

Dependency Hierarchy:

  • request-2.81.0.tgz (Root Library)
    • http-signature-1.1.1.tgz
      • jsprim-1.4.1.tgz
        • json-schema-0.2.3.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Publish Date: 2021-11-13

URL: CVE-2021-3918

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-3918

Release Date: 2021-11-13

Fix Resolution (json-schema): 0.4.0

Direct dependency fix Resolution (request): 2.82.0

CVE-2018-16492

Vulnerable Library - extend-3.0.1.tgz

Port of jQuery.extend for node.js and the browser

Library home page: https://registry.npmjs.org/extend/-/extend-3.0.1.tgz

Dependency Hierarchy:

  • request-2.81.0.tgz (Root Library)
    • extend-3.0.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16492

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/381185

Release Date: 2019-02-01

Fix Resolution (extend): 3.0.2

Direct dependency fix Resolution (request): 2.82.0

CVE-2018-1000620

Vulnerable Library - cryptiles-2.0.5.tgz

General purpose crypto utilities

Library home page: https://registry.npmjs.org/cryptiles/-/cryptiles-2.0.5.tgz

Dependency Hierarchy:

  • request-2.81.0.tgz (Root Library)
    • hawk-3.1.3.tgz
      • cryptiles-2.0.5.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Eran Hammer cryptiles version 4.1.1 earlier contains a CWE-331: Insufficient Entropy vulnerability in randomDigits() method that can result in An attacker is more likely to be able to brute force something that was supposed to be random.. This attack appear to be exploitable via Depends upon the calling application.. This vulnerability appears to have been fixed in 4.1.2.

Publish Date: 2018-07-09

URL: CVE-2018-1000620

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1000620

Release Date: 2018-07-09

Fix Resolution (cryptiles): 4.1.2

Direct dependency fix Resolution (request): 2.84.0

CVE-2018-3728

Vulnerable Library - hoek-2.16.3.tgz

General purpose node utilities

Library home page: https://registry.npmjs.org/hoek/-/hoek-2.16.3.tgz

Dependency Hierarchy:

  • request-2.81.0.tgz (Root Library)
    • hawk-3.1.3.tgz
      • hoek-2.16.3.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2018-03-30

URL: CVE-2018-3728

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16082

Release Date: 2018-03-30

Fix Resolution (hoek): 4.2.0

Direct dependency fix Resolution (request): 2.82.0

CVE-2022-24999

Vulnerable Library - qs-6.4.0.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-6.4.0.tgz

Dependency Hierarchy:

  • request-2.81.0.tgz (Root Library)
    • qs-6.4.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[proto]=b&a[proto]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: [email protected]" in its release description, is not vulnerable).

Publish Date: 2022-11-26

URL: CVE-2022-24999

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-24999

Release Date: 2022-11-26

Fix Resolution (qs): 6.4.1

Direct dependency fix Resolution (request): 2.82.0

CVE-2022-29167

Vulnerable Library - hawk-3.1.3.tgz

HTTP Hawk Authentication Scheme

Library home page: https://registry.npmjs.org/hawk/-/hawk-3.1.3.tgz

Dependency Hierarchy:

  • request-2.81.0.tgz (Root Library)
    • hawk-3.1.3.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response, covering the HTTP method, request URI, host, and optionally the request payload. Hawk used a regular expression to parse Host HTTP header (Hawk.utils.parseHost()), which was subject to regular expression DoS attack - meaning each added character in the attacker's input increases the computation time exponentially. parseHost() was patched in 9.0.1 to use built-in URL class to parse hostname instead. Hawk.authenticate() accepts options argument. If that contains host and port, those would be used instead of a call to utils.parseHost().

Publish Date: 2022-05-05

URL: CVE-2022-29167

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-44pw-h2cw-w3vq

Release Date: 2022-05-05

Fix Resolution: hawk - 9.0.1

CVE-2020-15366

Vulnerable Library - ajv-4.11.8.tgz

Another JSON Schema Validator

Library home page: https://registry.npmjs.org/ajv/-/ajv-4.11.8.tgz

Dependency Hierarchy:

  • request-2.81.0.tgz (Root Library)
    • har-validator-4.2.1.tgz
      • ajv-4.11.8.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)

Publish Date: 2020-07-15

URL: CVE-2020-15366

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-07-15

Fix Resolution (ajv): 6.12.3

Direct dependency fix Resolution (request): 2.88.0

firebase-admin-4.1.2.tgz: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - firebase-admin-4.1.2.tgz

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (firebase-admin version) Remediation Available
CVE-2020-7662 High 7.5 websocket-extensions-0.1.3.tgz Transitive 4.1.3

Details

CVE-2020-7662

Vulnerable Library - websocket-extensions-0.1.3.tgz

Generic extension manager for WebSocket connections

Library home page: https://registry.npmjs.org/websocket-extensions/-/websocket-extensions-0.1.3.tgz

Dependency Hierarchy:

  • firebase-admin-4.1.2.tgz (Root Library)
    • faye-websocket-0.9.3.tgz
      • websocket-driver-0.7.0.tgz
        • websocket-extensions-0.1.3.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

websocket-extensions npm module prior to 0.1.4 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header.

Publish Date: 2020-06-02

URL: CVE-2020-7662

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-g78m-2chm-r7qv

Release Date: 2020-06-02

Fix Resolution (websocket-extensions): 0.1.4

Direct dependency fix Resolution (firebase-admin): 4.1.3

cron-1.2.1.tgz: 2 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - cron-1.2.1.tgz

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (cron version) Remediation Available
WS-2022-0280 High 9.8 moment-timezone-0.5.17.tgz Transitive 1.8.3
WS-2022-0284 High 9.1 moment-timezone-0.5.17.tgz Transitive 1.8.3

Details

WS-2022-0280

Vulnerable Library - moment-timezone-0.5.17.tgz

Parse and display moments in any timezone.

Library home page: https://registry.npmjs.org/moment-timezone/-/moment-timezone-0.5.17.tgz

Dependency Hierarchy:

  • cron-1.2.1.tgz (Root Library)
    • moment-timezone-0.5.17.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Command Injection in moment-timezone before 0.5.35.

Publish Date: 2022-08-30

URL: WS-2022-0280

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-56x4-j7p9-fcf9

Release Date: 2022-08-30

Fix Resolution (moment-timezone): 0.5.35

Direct dependency fix Resolution (cron): 1.8.3

WS-2022-0284

Vulnerable Library - moment-timezone-0.5.17.tgz

Parse and display moments in any timezone.

Library home page: https://registry.npmjs.org/moment-timezone/-/moment-timezone-0.5.17.tgz

Dependency Hierarchy:

  • cron-1.2.1.tgz (Root Library)
    • moment-timezone-0.5.17.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Cleartext Transmission of Sensitive Information in moment-timezone

Publish Date: 2022-08-30

URL: WS-2022-0284

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-v78c-4p63-2j6c

Release Date: 2022-08-30

Fix Resolution (moment-timezone): 0.5.35

Direct dependency fix Resolution (cron): 1.8.3

morgan-1.7.0.tgz: 2 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - morgan-1.7.0.tgz

HTTP request logger middleware for node.js

Library home page: https://registry.npmjs.org/morgan/-/morgan-1.7.0.tgz

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (morgan version) Remediation Available
CVE-2019-5413 High 9.8 morgan-1.7.0.tgz Direct 1.9.1
CVE-2017-16137 Medium 5.3 debug-2.2.0.tgz Transitive 1.9.0

Details

CVE-2019-5413

Vulnerable Library - morgan-1.7.0.tgz

HTTP request logger middleware for node.js

Library home page: https://registry.npmjs.org/morgan/-/morgan-1.7.0.tgz

Dependency Hierarchy:

  • morgan-1.7.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1.

Publish Date: 2019-03-21

URL: CVE-2019-5413

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/390881

Release Date: 2019-10-09

Fix Resolution: 1.9.1

CVE-2017-16137

Vulnerable Library - debug-2.2.0.tgz

small debugging utility

Library home page: https://registry.npmjs.org/debug/-/debug-2.2.0.tgz

Dependency Hierarchy:

  • morgan-1.7.0.tgz (Root Library)
    • debug-2.2.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.

Publish Date: 2018-06-07

URL: CVE-2017-16137

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-16137

Release Date: 2018-06-07

Fix Resolution (debug): 2.6.9

Direct dependency fix Resolution (morgan): 1.9.0

storage-1.2.0.tgz: 8 vulnerabilities (highest severity is: 7.8)

Vulnerable Library - storage-1.2.0.tgz

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (storage version) Remediation Available
CVE-2021-43138 High 7.8 async-2.6.1.tgz Transitive 3.0.0
CVE-2022-24772 High 7.5 node-forge-0.7.5.tgz Transitive 5.0.0
CVE-2022-24771 High 7.5 node-forge-0.7.5.tgz Transitive 5.0.0
CVE-2020-8116 High 7.3 dot-prop-4.2.0.tgz Transitive 1.2.1
CVE-2020-7720 High 7.3 node-forge-0.7.5.tgz Transitive 1.6.0
WS-2022-0008 Medium 6.6 node-forge-0.7.5.tgz Transitive 5.0.0
CVE-2022-0122 Medium 6.1 node-forge-0.7.5.tgz Transitive 5.0.0
CVE-2022-24773 Medium 5.3 node-forge-0.7.5.tgz Transitive 5.0.0

Details

CVE-2021-43138

Vulnerable Library - async-2.6.1.tgz

Higher-order functions and common patterns for asynchronous code

Library home page: https://registry.npmjs.org/async/-/async-2.6.1.tgz

Dependency Hierarchy:

  • storage-1.2.0.tgz (Root Library)
    • async-2.6.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.

Publish Date: 2022-04-06

URL: CVE-2021-43138

CVSS 3 Score Details (7.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-43138

Release Date: 2022-04-06

Fix Resolution (async): 2.6.4

Direct dependency fix Resolution (@google-cloud/storage): 3.0.0

CVE-2022-24772

Vulnerable Library - node-forge-0.7.5.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.7.5.tgz

Dependency Hierarchy:

  • storage-1.2.0.tgz (Root Library)
    • common-0.13.6.tgz
      • google-auto-auth-0.7.2.tgz
        • google-auth-library-0.10.0.tgz
          • gtoken-1.2.3.tgz
            • google-p12-pem-0.1.2.tgz
              • node-forge-0.7.5.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a DigestInfo ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.

Publish Date: 2022-03-18

URL: CVE-2022-24772

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24772

Release Date: 2022-03-18

Fix Resolution (node-forge): 1.3.0

Direct dependency fix Resolution (@google-cloud/storage): 5.0.0

CVE-2022-24771

Vulnerable Library - node-forge-0.7.5.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.7.5.tgz

Dependency Hierarchy:

  • storage-1.2.0.tgz (Root Library)
    • common-0.13.6.tgz
      • google-auto-auth-0.7.2.tgz
        • google-auth-library-0.10.0.tgz
          • gtoken-1.2.3.tgz
            • google-p12-pem-0.1.2.tgz
              • node-forge-0.7.5.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.

Publish Date: 2022-03-18

URL: CVE-2022-24771

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24771

Release Date: 2022-03-18

Fix Resolution (node-forge): 1.3.0

Direct dependency fix Resolution (@google-cloud/storage): 5.0.0

CVE-2020-8116

Vulnerable Library - dot-prop-4.2.0.tgz

Get, set, or delete a property from a nested object using a dot path

Library home page: https://registry.npmjs.org/dot-prop/-/dot-prop-4.2.0.tgz

Dependency Hierarchy:

  • storage-1.2.0.tgz (Root Library)
    • gcs-resumable-upload-0.8.2.tgz
      • configstore-3.1.2.tgz
        • dot-prop-4.2.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.

Publish Date: 2020-02-04

URL: CVE-2020-8116

CVSS 3 Score Details (7.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8116

Release Date: 2020-02-04

Fix Resolution (dot-prop): 4.2.1

Direct dependency fix Resolution (@google-cloud/storage): 1.2.1

CVE-2020-7720

Vulnerable Library - node-forge-0.7.5.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.7.5.tgz

Dependency Hierarchy:

  • storage-1.2.0.tgz (Root Library)
    • common-0.13.6.tgz
      • google-auto-auth-0.7.2.tgz
        • google-auth-library-0.10.0.tgz
          • gtoken-1.2.3.tgz
            • google-p12-pem-0.1.2.tgz
              • node-forge-0.7.5.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.

Publish Date: 2020-09-01

URL: CVE-2020-7720

CVSS 3 Score Details (7.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-09-01

Fix Resolution (node-forge): 0.10.0

Direct dependency fix Resolution (@google-cloud/storage): 1.6.0

WS-2022-0008

Vulnerable Library - node-forge-0.7.5.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.7.5.tgz

Dependency Hierarchy:

  • storage-1.2.0.tgz (Root Library)
    • common-0.13.6.tgz
      • google-auto-auth-0.7.2.tgz
        • google-auth-library-0.10.0.tgz
          • gtoken-1.2.3.tgz
            • google-p12-pem-0.1.2.tgz
              • node-forge-0.7.5.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The forge.debug API had a potential prototype pollution issue if called with untrusted input. The API was only used for internal debug purposes in a safe way and never documented or advertised. It is suspected that uses of this API, if any exist, would likely not have used untrusted inputs in a vulnerable way.

Publish Date: 2022-01-08

URL: WS-2022-0008

CVSS 3 Score Details (6.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5rrq-pxf6-6jx5

Release Date: 2022-01-08

Fix Resolution (node-forge): 1.0.0

Direct dependency fix Resolution (@google-cloud/storage): 5.0.0

CVE-2022-0122

Vulnerable Library - node-forge-0.7.5.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.7.5.tgz

Dependency Hierarchy:

  • storage-1.2.0.tgz (Root Library)
    • common-0.13.6.tgz
      • google-auto-auth-0.7.2.tgz
        • google-auth-library-0.10.0.tgz
          • gtoken-1.2.3.tgz
            • google-p12-pem-0.1.2.tgz
              • node-forge-0.7.5.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

forge is vulnerable to URL Redirection to Untrusted Site

Publish Date: 2022-01-06

URL: CVE-2022-0122

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-gf8q-jrpm-jvxq

Release Date: 2022-01-06

Fix Resolution (node-forge): 1.0.0

Direct dependency fix Resolution (@google-cloud/storage): 5.0.0

CVE-2022-24773

Vulnerable Library - node-forge-0.7.5.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.7.5.tgz

Dependency Hierarchy:

  • storage-1.2.0.tgz (Root Library)
    • common-0.13.6.tgz
      • google-auto-auth-0.7.2.tgz
        • google-auth-library-0.10.0.tgz
          • gtoken-1.2.3.tgz
            • google-p12-pem-0.1.2.tgz
              • node-forge-0.7.5.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not properly check DigestInfo for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.

Publish Date: 2022-03-18

URL: CVE-2022-24773

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24773

Release Date: 2022-03-18

Fix Resolution (node-forge): 1.3.0

Direct dependency fix Resolution (@google-cloud/storage): 5.0.0

Unauthorized message

I am getting "Unauthorized" error message after run successfully. please see screenshot, please let me know what is the issues.

image

express-winston-2.1.2.tgz: 7 vulnerabilities (highest severity is: 9.1)

Vulnerable Library - express-winston-2.1.2.tgz

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (express-winston version) Remediation Available
CVE-2019-10744 High 9.1 lodash-4.11.2.tgz Transitive 2.5.0
CVE-2020-8203 High 7.4 lodash-4.11.2.tgz Transitive 2.5.0
CVE-2021-23337 High 7.2 lodash-4.11.2.tgz Transitive 2.5.0
CVE-2019-1010266 Medium 6.5 lodash-4.11.2.tgz Transitive 2.5.0
CVE-2018-3721 Medium 6.5 lodash-4.11.2.tgz Transitive 2.5.0
CVE-2018-16487 Medium 5.6 lodash-4.11.2.tgz Transitive 2.5.0
CVE-2020-28500 Medium 5.3 lodash-4.11.2.tgz Transitive 2.5.0

Details

CVE-2019-10744

Vulnerable Library - lodash-4.11.2.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.11.2.tgz

Dependency Hierarchy:

  • express-winston-2.1.2.tgz (Root Library)
    • lodash-4.11.2.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-26

URL: CVE-2019-10744

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jf85-cpcp-j695

Release Date: 2019-07-26

Fix Resolution (lodash): 4.17.12

Direct dependency fix Resolution (express-winston): 2.5.0

CVE-2020-8203

Vulnerable Library - lodash-4.11.2.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.11.2.tgz

Dependency Hierarchy:

  • express-winston-2.1.2.tgz (Root Library)
    • lodash-4.11.2.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-07-15

Fix Resolution (lodash): 4.17.9

Direct dependency fix Resolution (express-winston): 2.5.0

CVE-2021-23337

Vulnerable Library - lodash-4.11.2.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.11.2.tgz

Dependency Hierarchy:

  • express-winston-2.1.2.tgz (Root Library)
    • lodash-4.11.2.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-02-15

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (express-winston): 2.5.0

CVE-2019-1010266

Vulnerable Library - lodash-4.11.2.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.11.2.tgz

Dependency Hierarchy:

  • express-winston-2.1.2.tgz (Root Library)
    • lodash-4.11.2.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Publish Date: 2019-07-17

URL: CVE-2019-1010266

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010266

Release Date: 2019-07-17

Fix Resolution (lodash): 4.17.11

Direct dependency fix Resolution (express-winston): 2.5.0

CVE-2018-3721

Vulnerable Library - lodash-4.11.2.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.11.2.tgz

Dependency Hierarchy:

  • express-winston-2.1.2.tgz (Root Library)
    • lodash-4.11.2.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2018-06-07

URL: CVE-2018-3721

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3721

Release Date: 2018-06-07

Fix Resolution (lodash): 4.17.5

Direct dependency fix Resolution (express-winston): 2.5.0

CVE-2018-16487

Vulnerable Library - lodash-4.11.2.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.11.2.tgz

Dependency Hierarchy:

  • express-winston-2.1.2.tgz (Root Library)
    • lodash-4.11.2.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16487

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16487

Release Date: 2019-02-01

Fix Resolution (lodash): 4.17.11

Direct dependency fix Resolution (express-winston): 2.5.0

CVE-2020-28500

Vulnerable Library - lodash-4.11.2.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.11.2.tgz

Dependency Hierarchy:

  • express-winston-2.1.2.tgz (Root Library)
    • lodash-4.11.2.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
Mend Note: After conducting further research, Mend has determined that CVE-2020-28500 only affects environments with versions 4.0.0 to 4.17.20 of Lodash.

Publish Date: 2021-02-15

URL: CVE-2020-28500

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28500

Release Date: 2021-02-15

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (express-winston): 2.5.0

express-jwt-5.1.0.tgz: 5 vulnerabilities (highest severity is: 9.1)

Vulnerable Library - express-jwt-5.1.0.tgz

JWT authentication middleware.

Library home page: https://registry.npmjs.org/express-jwt/-/express-jwt-5.1.0.tgz

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (express-jwt version) Remediation Available
CVE-2020-15084 High 9.1 express-jwt-5.1.0.tgz Direct 6.0.0
CVE-2022-23529 High 7.6 jsonwebtoken-6.2.0.tgz Transitive N/A*
CVE-2022-23540 Medium 6.4 jsonwebtoken-6.2.0.tgz Transitive N/A*
CVE-2022-23539 Medium 5.9 jsonwebtoken-6.2.0.tgz Transitive N/A*
CVE-2022-23541 Medium 5.0 jsonwebtoken-6.2.0.tgz Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

CVE-2020-15084

Vulnerable Library - express-jwt-5.1.0.tgz

JWT authentication middleware.

Library home page: https://registry.npmjs.org/express-jwt/-/express-jwt-5.1.0.tgz

Dependency Hierarchy:

  • express-jwt-5.1.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

In express-jwt (NPM package) up and including version 5.3.3, the algorithms entry to be specified in the configuration is not being enforced. When algorithms is not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization bypass. You are affected by this vulnerability if all of the following conditions apply: - You are using express-jwt - You do not have algorithms configured in your express-jwt configuration. - You are using libraries such as jwks-rsa as the secret. You can fix this by specifying algorithms in the express-jwt configuration. See linked GHSA for example. This is also fixed in version 6.0.0.

Publish Date: 2020-06-30

URL: CVE-2020-15084

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-6g6m-m6h5-w9gf

Release Date: 2020-06-30

Fix Resolution: 6.0.0

CVE-2022-23529

Vulnerable Library - jsonwebtoken-6.2.0.tgz

JSON Web Token implementation (symmetric and asymmetric)

Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-6.2.0.tgz

Dependency Hierarchy:

  • express-jwt-5.1.0.tgz (Root Library)
    • jsonwebtoken-6.2.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

node-jsonwebtoken is a JsonWebToken implementation for node.js. For versions <= 8.5.1 of jsonwebtoken library, if a malicious actor has the ability to modify the key retrieval parameter (referring to the secretOrPublicKey argument from the readme link of the jwt.verify() function, they can write arbitrary files on the host machine. Users are affected only if untrusted entities are allowed to modify the key retrieval parameter of the jwt.verify() on a host that you control. This issue has been fixed, please update to version 9.0.0.

Publish Date: 2022-12-21

URL: CVE-2022-23529

CVSS 3 Score Details (7.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: High
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-27h2-hvpr-p74q

Release Date: 2022-12-21

Fix Resolution: jsonwebtoken - 9.0.0

CVE-2022-23540

Vulnerable Library - jsonwebtoken-6.2.0.tgz

JSON Web Token implementation (symmetric and asymmetric)

Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-6.2.0.tgz

Dependency Hierarchy:

  • express-jwt-5.1.0.tgz (Root Library)
    • jsonwebtoken-6.2.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

In versions <=8.5.1 of jsonwebtoken library, lack of algorithm definition in the jwt.verify() function can lead to signature validation bypass due to defaulting to the none algorithm for signature verification. Users are affected if you do not specify algorithms in the jwt.verify() function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in the jwt.verify() method. There will be no impact, if you update to version 9.0.0 and you don’t need to allow for the none algorithm. If you need 'none' algorithm, you have to explicitly specify that in jwt.verify() options.

Publish Date: 2022-12-22

URL: CVE-2022-23540

CVSS 3 Score Details (6.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: High
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-23540

Release Date: 2022-12-22

Fix Resolution: jsonwebtoken - 9.0.0

CVE-2022-23539

Vulnerable Library - jsonwebtoken-6.2.0.tgz

JSON Web Token implementation (symmetric and asymmetric)

Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-6.2.0.tgz

Dependency Hierarchy:

  • express-jwt-5.1.0.tgz (Root Library)
    • jsonwebtoken-6.2.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Versions <=8.5.1 of jsonwebtoken library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, if you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you’ll need to set the allowInvalidAsymmetricKeyTypes option to true in the sign() and/or verify() functions.

Publish Date: 2022-12-23

URL: CVE-2022-23539

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8cf7-32gw-wr33

Release Date: 2022-12-23

Fix Resolution: jsonwebtoken - 9.0.0

CVE-2022-23541

Vulnerable Library - jsonwebtoken-6.2.0.tgz

JSON Web Token implementation (symmetric and asymmetric)

Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-6.2.0.tgz

Dependency Hierarchy:

  • express-jwt-5.1.0.tgz (Root Library)
    • jsonwebtoken-6.2.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

jsonwebtoken is an implementation of JSON Web Tokens. Versions <= 8.5.1 of jsonwebtoken library can be misconfigured so that passing a poorly implemented key retrieval function referring to the secretOrPublicKey argument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0.

Publish Date: 2022-12-22

URL: CVE-2022-23541

CVSS 3 Score Details (5.0)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hjrf-2m68-5959

Release Date: 2022-12-22

Fix Resolution: jsonwebtoken - 9.0.0

Error when trying to login after installation

Hello,

I installed the application on my server but when i try to login, i get a 404 on http://localhost:3004/api/admin/XXXXX

I can see that i'm well authenticated on firebase but fail on the getAdmins() function.

It looks like i need to initialize my database with some data or fiels ?

I can't find any documentation on this.

How do i create the first user in firebase ?

Thank you very much

moment-2.22.2.tgz: 2 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - moment-2.22.2.tgz

Parse, validate, manipulate, and display dates

Library home page: https://registry.npmjs.org/moment/-/moment-2.22.2.tgz

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (moment version) Remediation Available
CVE-2022-31129 High 7.5 moment-2.22.2.tgz Direct moment - 2.29.4
CVE-2022-24785 High 7.5 moment-2.22.2.tgz Direct 2.29.2

Details

CVE-2022-31129

Vulnerable Library - moment-2.22.2.tgz

Parse, validate, manipulate, and display dates

Library home page: https://registry.npmjs.org/moment/-/moment-2.22.2.tgz

Dependency Hierarchy:

  • moment-2.22.2.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k characters. Users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider limiting date lengths accepted from user input.

Publish Date: 2022-07-06

URL: CVE-2022-31129

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-wc69-rhjr-hc9g

Release Date: 2022-07-06

Fix Resolution: moment - 2.29.4

CVE-2022-24785

Vulnerable Library - moment-2.22.2.tgz

Parse, validate, manipulate, and display dates

Library home page: https://registry.npmjs.org/moment/-/moment-2.22.2.tgz

Dependency Hierarchy:

  • moment-2.22.2.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.

Publish Date: 2022-04-04

URL: CVE-2022-24785

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8hfj-j24r-96c4

Release Date: 2022-04-04

Fix Resolution: 2.29.2

Error: Cannot find module '../../firebaseCredentials.json'

Hi Team,

I tried to compile ibs-api and getting the below error. Now as I can see there is no file firebaseCredentials.json in the project folder. Also, all the information related to firebase has been defined in the .env files. Can you please have a look and help me out with this. Thanks.

yarn run v1.22.4
$ gulp serve
[08:24:33] Failed to load external module @babel/register
[08:24:33] Requiring external module babel-register
[08:24:33] Using gulpfile /var/www/html/interactive-broadcast-api/gulpfile.babel.js
[08:24:33] Starting 'clean'...
[08:24:34] Finished 'clean' after 27 ms
[08:24:34] Starting 'serve'...
[08:24:34] Starting 'copy'...
[08:24:34] Starting 'babel'...
[08:24:34] Finished 'serve' after 67 ms
[08:24:36] Finished 'copy' after 2.45 s
[08:24:37] Finished 'babel' after 3.48 s
[08:24:37] Starting 'nodemon'...
[08:24:37] Finished 'nodemon' after 65 ms
[08:24:37] [nodemon] 1.17.5
[08:24:37] [nodemon] to restart at any time, enter rs
[08:24:37] [nodemon] watching: .
[08:24:37] [nodemon] starting node dist/index.js
module.js:549
throw err;
^

Error: Cannot find module '../../firebaseCredentials.json'
at Function.Module._resolveFilename (module.js:547:15)
at Function.Module._load (module.js:474:25)
at Module.require (module.js:596:17)
at require (internal/module.js:11:18)
at Object. (/var/www/html/interactive-broadcast-api/dist/server/services/firebase.js:11:28)
at Module._compile (module.js:652:30)
at Object.Module._extensions..js (module.js:663:10)
at Module.load (module.js:565:32)
at tryModuleLoad (module.js:505:12)
at Function.Module._load (module.js:497:3)
[08:24:38] [nodemon] app crashed - waiting for file changes before starting...

helmet-3.1.0.tgz: 1 vulnerabilities (highest severity is: 6.1)

Vulnerable Library - helmet-3.1.0.tgz

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (helmet version) Remediation Available
WS-2019-0289 Medium 6.1 helmet-csp-2.1.0.tgz Transitive 3.21.0

Details

WS-2019-0289

Vulnerable Library - helmet-csp-2.1.0.tgz

Content Security Policy middleware.

Library home page: https://registry.npmjs.org/helmet-csp/-/helmet-csp-2.1.0.tgz

Dependency Hierarchy:

  • helmet-3.1.0.tgz (Root Library)
    • helmet-csp-2.1.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Helmet-csp before 2.9.1 is vulnerable to a Configuration Override affecting the application's Content Security Policy (CSP). The package's browser sniffing for Firefox deletes the default-src CSP policy, which is the fallback policy. This allows an attacker to remove an application's default CSP, possibly rendering the application vulnerable to Cross-Site Scripting.

Publish Date: 2019-11-18

URL: WS-2019-0289

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1176

Release Date: 2019-11-18

Fix Resolution (helmet-csp): 2.9.1

Direct dependency fix Resolution (helmet): 3.21.0

The engine "node" is incompatible with this module

New issue checklist

General information

  • Library version(s):
  • iOS/Android/Browser version(s):
  • Devices/Simulators/Machine affected:
  • Reproducible in the demo project? (Yes/No):
  • Related issues:
    Validating package.json...

error [email protected]: The engine "node" is incompatible with this module. Expected version "8.10.0". Got "14.15.1"
error Found incompatible module.

Bug report

Expected behavior

...

Actual behavior

...

Steps to reproduce

...

Crash log? Screenshots? Videos? Sample project?

...

Question or Feature Request

...

express-4.14.0.tgz: 4 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - express-4.14.0.tgz

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (express version) Remediation Available
CVE-2022-24999 High 7.5 qs-6.2.0.tgz Transitive 4.15.0
CVE-2017-1000048 High 7.5 qs-6.2.0.tgz Transitive 4.15.0
CVE-2017-16138 High 7.5 mime-1.3.4.tgz Transitive 4.16.0
CVE-2017-16119 High 7.5 fresh-0.3.0.tgz Transitive 4.15.5

Details

CVE-2022-24999

Vulnerable Library - qs-6.2.0.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-6.2.0.tgz

Dependency Hierarchy:

  • express-4.14.0.tgz (Root Library)
    • qs-6.2.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[proto]=b&a[proto]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: [email protected]" in its release description, is not vulnerable).

Publish Date: 2022-11-26

URL: CVE-2022-24999

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-24999

Release Date: 2022-11-26

Fix Resolution (qs): 6.2.4

Direct dependency fix Resolution (express): 4.15.0

CVE-2017-1000048

Vulnerable Library - qs-6.2.0.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-6.2.0.tgz

Dependency Hierarchy:

  • express-4.14.0.tgz (Root Library)
    • qs-6.2.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. A malicious user can send a evil request to cause the web framework crash.

Publish Date: 2017-07-17

URL: CVE-2017-1000048

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000048

Release Date: 2017-07-17

Fix Resolution (qs): 6.2.3

Direct dependency fix Resolution (express): 4.15.0

CVE-2017-16138

Vulnerable Library - mime-1.3.4.tgz

A comprehensive library for mime-type mapping

Library home page: https://registry.npmjs.org/mime/-/mime-1.3.4.tgz

Dependency Hierarchy:

  • express-4.14.0.tgz (Root Library)
    • serve-static-1.11.2.tgz
      • send-0.14.2.tgz
        • mime-1.3.4.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The mime module < 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.

Publish Date: 2018-06-07

URL: CVE-2017-16138

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16138

Release Date: 2018-06-07

Fix Resolution (mime): 1.4.1

Direct dependency fix Resolution (express): 4.16.0

CVE-2017-16119

Vulnerable Library - fresh-0.3.0.tgz

HTTP response freshness testing

Library home page: https://registry.npmjs.org/fresh/-/fresh-0.3.0.tgz

Dependency Hierarchy:

  • express-4.14.0.tgz (Root Library)
    • fresh-0.3.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.

Publish Date: 2018-06-07

URL: CVE-2017-16119

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/526

Release Date: 2018-06-07

Fix Resolution (fresh): 0.5.2

Direct dependency fix Resolution (express): 4.15.5

jsonwebtoken-7.1.9.tgz: 7 vulnerabilities (highest severity is: 7.6)

Vulnerable Library - jsonwebtoken-7.1.9.tgz

JSON Web Token implementation (symmetric and asymmetric)

Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-7.1.9.tgz

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (jsonwebtoken version) Remediation Available
CVE-2022-23529 High 7.6 jsonwebtoken-7.1.9.tgz Direct jsonwebtoken - 9.0.0
CVE-2022-31129 High 7.5 moment-2.18.1.tgz Transitive N/A*
CVE-2017-18214 High 7.5 moment-2.18.1.tgz Transitive 7.1.10
CVE-2022-24785 High 7.5 moment-2.18.1.tgz Transitive 7.2.0
CVE-2022-23540 Medium 6.4 jsonwebtoken-7.1.9.tgz Direct jsonwebtoken - 9.0.0
CVE-2022-23539 Medium 5.9 jsonwebtoken-7.1.9.tgz Direct jsonwebtoken - 9.0.0
CVE-2022-23541 Medium 5.0 jsonwebtoken-7.1.9.tgz Direct jsonwebtoken - 9.0.0

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

CVE-2022-23529

Vulnerable Library - jsonwebtoken-7.1.9.tgz

JSON Web Token implementation (symmetric and asymmetric)

Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-7.1.9.tgz

Dependency Hierarchy:

  • jsonwebtoken-7.1.9.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

node-jsonwebtoken is a JsonWebToken implementation for node.js. For versions <= 8.5.1 of jsonwebtoken library, if a malicious actor has the ability to modify the key retrieval parameter (referring to the secretOrPublicKey argument from the readme link of the jwt.verify() function, they can write arbitrary files on the host machine. Users are affected only if untrusted entities are allowed to modify the key retrieval parameter of the jwt.verify() on a host that you control. This issue has been fixed, please update to version 9.0.0.

Publish Date: 2022-12-21

URL: CVE-2022-23529

CVSS 3 Score Details (7.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: High
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-27h2-hvpr-p74q

Release Date: 2022-12-21

Fix Resolution: jsonwebtoken - 9.0.0

CVE-2022-31129

Vulnerable Library - moment-2.18.1.tgz

Parse, validate, manipulate, and display dates

Library home page: https://registry.npmjs.org/moment/-/moment-2.18.1.tgz

Dependency Hierarchy:

  • jsonwebtoken-7.1.9.tgz (Root Library)
    • joi-6.10.1.tgz
      • moment-2.18.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k characters. Users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider limiting date lengths accepted from user input.

Publish Date: 2022-07-06

URL: CVE-2022-31129

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-wc69-rhjr-hc9g

Release Date: 2022-07-06

Fix Resolution: moment - 2.29.4

CVE-2017-18214

Vulnerable Library - moment-2.18.1.tgz

Parse, validate, manipulate, and display dates

Library home page: https://registry.npmjs.org/moment/-/moment-2.18.1.tgz

Dependency Hierarchy:

  • jsonwebtoken-7.1.9.tgz (Root Library)
    • joi-6.10.1.tgz
      • moment-2.18.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulnerability than CVE-2016-4055.

Publish Date: 2018-03-04

URL: CVE-2017-18214

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-446m-mv8f-q348

Release Date: 2018-03-04

Fix Resolution (moment): 2.19.3

Direct dependency fix Resolution (jsonwebtoken): 7.1.10

CVE-2022-24785

Vulnerable Library - moment-2.18.1.tgz

Parse, validate, manipulate, and display dates

Library home page: https://registry.npmjs.org/moment/-/moment-2.18.1.tgz

Dependency Hierarchy:

  • jsonwebtoken-7.1.9.tgz (Root Library)
    • joi-6.10.1.tgz
      • moment-2.18.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.

Publish Date: 2022-04-04

URL: CVE-2022-24785

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8hfj-j24r-96c4

Release Date: 2022-04-04

Fix Resolution (moment): 2.29.2

Direct dependency fix Resolution (jsonwebtoken): 7.2.0

CVE-2022-23540

Vulnerable Library - jsonwebtoken-7.1.9.tgz

JSON Web Token implementation (symmetric and asymmetric)

Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-7.1.9.tgz

Dependency Hierarchy:

  • jsonwebtoken-7.1.9.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

In versions <=8.5.1 of jsonwebtoken library, lack of algorithm definition in the jwt.verify() function can lead to signature validation bypass due to defaulting to the none algorithm for signature verification. Users are affected if you do not specify algorithms in the jwt.verify() function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in the jwt.verify() method. There will be no impact, if you update to version 9.0.0 and you don’t need to allow for the none algorithm. If you need 'none' algorithm, you have to explicitly specify that in jwt.verify() options.

Publish Date: 2022-12-22

URL: CVE-2022-23540

CVSS 3 Score Details (6.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: High
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-23540

Release Date: 2022-12-22

Fix Resolution: jsonwebtoken - 9.0.0

CVE-2022-23539

Vulnerable Library - jsonwebtoken-7.1.9.tgz

JSON Web Token implementation (symmetric and asymmetric)

Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-7.1.9.tgz

Dependency Hierarchy:

  • jsonwebtoken-7.1.9.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Versions <=8.5.1 of jsonwebtoken library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, if you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you’ll need to set the allowInvalidAsymmetricKeyTypes option to true in the sign() and/or verify() functions.

Publish Date: 2022-12-23

URL: CVE-2022-23539

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8cf7-32gw-wr33

Release Date: 2022-12-23

Fix Resolution: jsonwebtoken - 9.0.0

CVE-2022-23541

Vulnerable Library - jsonwebtoken-7.1.9.tgz

JSON Web Token implementation (symmetric and asymmetric)

Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-7.1.9.tgz

Dependency Hierarchy:

  • jsonwebtoken-7.1.9.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

jsonwebtoken is an implementation of JSON Web Tokens. Versions <= 8.5.1 of jsonwebtoken library can be misconfigured so that passing a poorly implemented key retrieval function referring to the secretOrPublicKey argument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0.

Publish Date: 2022-12-22

URL: CVE-2022-23541

CVSS 3 Score Details (5.0)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hjrf-2m68-5959

Release Date: 2022-12-22

Fix Resolution: jsonwebtoken - 9.0.0

express-validation-1.0.1.tgz: 6 vulnerabilities (highest severity is: 9.1)

Vulnerable Library - express-validation-1.0.1.tgz

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (express-validation version) Remediation Available
CVE-2019-10744 High 9.1 lodash-4.17.10.tgz Transitive 1.0.2
CVE-2020-8203 High 7.4 lodash-4.17.10.tgz Transitive 1.0.2
CVE-2021-23337 High 7.2 lodash-4.17.10.tgz Transitive 1.0.2
CVE-2019-1010266 Medium 6.5 lodash-4.17.10.tgz Transitive 1.0.2
CVE-2018-16487 Medium 5.6 lodash-4.17.10.tgz Transitive 1.0.2
CVE-2020-28500 Medium 5.3 lodash-4.17.10.tgz Transitive 1.0.2

Details

CVE-2019-10744

Vulnerable Library - lodash-4.17.10.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.10.tgz

Dependency Hierarchy:

  • express-validation-1.0.1.tgz (Root Library)
    • lodash-4.17.10.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-26

URL: CVE-2019-10744

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jf85-cpcp-j695

Release Date: 2019-07-26

Fix Resolution (lodash): 4.17.12

Direct dependency fix Resolution (express-validation): 1.0.2

CVE-2020-8203

Vulnerable Library - lodash-4.17.10.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.10.tgz

Dependency Hierarchy:

  • express-validation-1.0.1.tgz (Root Library)
    • lodash-4.17.10.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-07-15

Fix Resolution (lodash): 4.17.19

Direct dependency fix Resolution (express-validation): 1.0.2

CVE-2021-23337

Vulnerable Library - lodash-4.17.10.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.10.tgz

Dependency Hierarchy:

  • express-validation-1.0.1.tgz (Root Library)
    • lodash-4.17.10.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-02-15

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (express-validation): 1.0.2

CVE-2019-1010266

Vulnerable Library - lodash-4.17.10.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.10.tgz

Dependency Hierarchy:

  • express-validation-1.0.1.tgz (Root Library)
    • lodash-4.17.10.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Publish Date: 2019-07-17

URL: CVE-2019-1010266

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010266

Release Date: 2019-07-17

Fix Resolution (lodash): 4.17.11

Direct dependency fix Resolution (express-validation): 1.0.2

CVE-2018-16487

Vulnerable Library - lodash-4.17.10.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.10.tgz

Dependency Hierarchy:

  • express-validation-1.0.1.tgz (Root Library)
    • lodash-4.17.10.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16487

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16487

Release Date: 2019-02-01

Fix Resolution (lodash): 4.17.11

Direct dependency fix Resolution (express-validation): 1.0.2

CVE-2020-28500

Vulnerable Library - lodash-4.17.10.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.10.tgz

Dependency Hierarchy:

  • express-validation-1.0.1.tgz (Root Library)
    • lodash-4.17.10.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
Mend Note: After conducting further research, Mend has determined that CVE-2020-28500 only affects environments with versions 4.0.0 to 4.17.20 of Lodash.

Publish Date: 2021-02-15

URL: CVE-2020-28500

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28500

Release Date: 2021-02-15

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (express-validation): 1.0.2

winston-2.3.0.tgz: 1 vulnerabilities (highest severity is: 7.8) - autoclosed

Vulnerable Library - winston-2.3.0.tgz

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (winston version) Remediation Available
CVE-2021-43138 High 7.8 async-1.0.0.tgz Transitive 2.4.6

Details

CVE-2021-43138

Vulnerable Library - async-1.0.0.tgz

Higher-order functions and common patterns for asynchronous code

Library home page: https://registry.npmjs.org/async/-/async-1.0.0.tgz

Dependency Hierarchy:

  • winston-2.3.0.tgz (Root Library)
    • async-1.0.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.

Publish Date: 2022-04-06

URL: CVE-2021-43138

CVSS 3 Score Details (7.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-43138

Release Date: 2022-04-06

Fix Resolution (async): 2.6.4

Direct dependency fix Resolution (winston): 2.4.6

opentok-2.9.1.tgz: 9 vulnerabilities (highest severity is: 7.6)

Vulnerable Library - opentok-2.9.1.tgz

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (opentok version) Remediation Available
CVE-2022-23529 High 7.6 jsonwebtoken-8.5.1.tgz Transitive N/A*
CVE-2022-24999 High 7.5 qs-6.5.2.tgz Transitive 2.9.2
CVE-2020-8203 High 7.4 lodash-4.17.15.tgz Transitive 2.9.2
CVE-2021-23337 High 7.2 lodash-4.17.15.tgz Transitive 2.9.2
CVE-2022-23540 Medium 6.4 jsonwebtoken-8.5.1.tgz Transitive N/A*
CVE-2022-23539 Medium 5.9 jsonwebtoken-8.5.1.tgz Transitive N/A*
CVE-2020-15366 Medium 5.6 ajv-6.10.2.tgz Transitive 2.9.2
CVE-2020-28500 Medium 5.3 lodash-4.17.15.tgz Transitive 2.9.2
CVE-2022-23541 Medium 5.0 jsonwebtoken-8.5.1.tgz Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

CVE-2022-23529

Vulnerable Library - jsonwebtoken-8.5.1.tgz

JSON Web Token implementation (symmetric and asymmetric)

Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz

Dependency Hierarchy:

  • opentok-2.9.1.tgz (Root Library)
    • jsonwebtoken-8.5.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

node-jsonwebtoken is a JsonWebToken implementation for node.js. For versions <= 8.5.1 of jsonwebtoken library, if a malicious actor has the ability to modify the key retrieval parameter (referring to the secretOrPublicKey argument from the readme link of the jwt.verify() function, they can write arbitrary files on the host machine. Users are affected only if untrusted entities are allowed to modify the key retrieval parameter of the jwt.verify() on a host that you control. This issue has been fixed, please update to version 9.0.0.

Publish Date: 2022-12-21

URL: CVE-2022-23529

CVSS 3 Score Details (7.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: High
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-27h2-hvpr-p74q

Release Date: 2022-12-21

Fix Resolution: jsonwebtoken - 9.0.0

CVE-2022-24999

Vulnerable Library - qs-6.5.2.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-6.5.2.tgz

Dependency Hierarchy:

  • opentok-2.9.1.tgz (Root Library)
    • request-2.88.0.tgz
      • qs-6.5.2.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[proto]=b&a[proto]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: [email protected]" in its release description, is not vulnerable).

Publish Date: 2022-11-26

URL: CVE-2022-24999

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-24999

Release Date: 2022-11-26

Fix Resolution (qs): 6.5.3

Direct dependency fix Resolution (opentok): 2.9.2

CVE-2020-8203

Vulnerable Library - lodash-4.17.15.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz

Dependency Hierarchy:

  • opentok-2.9.1.tgz (Root Library)
    • lodash-4.17.15.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-07-15

Fix Resolution (lodash): 4.17.19

Direct dependency fix Resolution (opentok): 2.9.2

CVE-2021-23337

Vulnerable Library - lodash-4.17.15.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz

Dependency Hierarchy:

  • opentok-2.9.1.tgz (Root Library)
    • lodash-4.17.15.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-02-15

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (opentok): 2.9.2

CVE-2022-23540

Vulnerable Library - jsonwebtoken-8.5.1.tgz

JSON Web Token implementation (symmetric and asymmetric)

Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz

Dependency Hierarchy:

  • opentok-2.9.1.tgz (Root Library)
    • jsonwebtoken-8.5.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

In versions <=8.5.1 of jsonwebtoken library, lack of algorithm definition in the jwt.verify() function can lead to signature validation bypass due to defaulting to the none algorithm for signature verification. Users are affected if you do not specify algorithms in the jwt.verify() function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in the jwt.verify() method. There will be no impact, if you update to version 9.0.0 and you don’t need to allow for the none algorithm. If you need 'none' algorithm, you have to explicitly specify that in jwt.verify() options.

Publish Date: 2022-12-22

URL: CVE-2022-23540

CVSS 3 Score Details (6.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: High
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-23540

Release Date: 2022-12-22

Fix Resolution: jsonwebtoken - 9.0.0

CVE-2022-23539

Vulnerable Library - jsonwebtoken-8.5.1.tgz

JSON Web Token implementation (symmetric and asymmetric)

Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz

Dependency Hierarchy:

  • opentok-2.9.1.tgz (Root Library)
    • jsonwebtoken-8.5.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Versions <=8.5.1 of jsonwebtoken library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, if you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you’ll need to set the allowInvalidAsymmetricKeyTypes option to true in the sign() and/or verify() functions.

Publish Date: 2022-12-23

URL: CVE-2022-23539

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8cf7-32gw-wr33

Release Date: 2022-12-23

Fix Resolution: jsonwebtoken - 9.0.0

CVE-2020-15366

Vulnerable Library - ajv-6.10.2.tgz

Another JSON Schema Validator

Library home page: https://registry.npmjs.org/ajv/-/ajv-6.10.2.tgz

Dependency Hierarchy:

  • opentok-2.9.1.tgz (Root Library)
    • request-2.88.0.tgz
      • har-validator-5.1.3.tgz
        • ajv-6.10.2.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)

Publish Date: 2020-07-15

URL: CVE-2020-15366

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-07-15

Fix Resolution (ajv): 6.12.3

Direct dependency fix Resolution (opentok): 2.9.2

CVE-2020-28500

Vulnerable Library - lodash-4.17.15.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz

Dependency Hierarchy:

  • opentok-2.9.1.tgz (Root Library)
    • lodash-4.17.15.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
Mend Note: After conducting further research, Mend has determined that CVE-2020-28500 only affects environments with versions 4.0.0 to 4.17.20 of Lodash.

Publish Date: 2021-02-15

URL: CVE-2020-28500

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28500

Release Date: 2021-02-15

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (opentok): 2.9.2

CVE-2022-23541

Vulnerable Library - jsonwebtoken-8.5.1.tgz

JSON Web Token implementation (symmetric and asymmetric)

Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz

Dependency Hierarchy:

  • opentok-2.9.1.tgz (Root Library)
    • jsonwebtoken-8.5.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

jsonwebtoken is an implementation of JSON Web Tokens. Versions <= 8.5.1 of jsonwebtoken library can be misconfigured so that passing a poorly implemented key retrieval function referring to the secretOrPublicKey argument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0.

Publish Date: 2022-12-22

URL: CVE-2022-23541

CVSS 3 Score Details (5.0)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hjrf-2m68-5959

Release Date: 2022-12-22

Fix Resolution: jsonwebtoken - 9.0.0

ramda-0.23.0.tgz: 1 vulnerabilities (highest severity is: 9.1)

Vulnerable Library - ramda-0.23.0.tgz

A practical functional library for JavaScript programmers.

Library home page: https://registry.npmjs.org/ramda/-/ramda-0.23.0.tgz

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (ramda version) Remediation Available
CVE-2021-42581 High 9.1 ramda-0.23.0.tgz Direct 0.27.1

Details

CVE-2021-42581

Vulnerable Library - ramda-0.23.0.tgz

A practical functional library for JavaScript programmers.

Library home page: https://registry.npmjs.org/ramda/-/ramda-0.23.0.tgz

Dependency Hierarchy:

  • ramda-0.23.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

** DISPUTED ** Prototype poisoning in function mapObjIndexed in Ramda 0.27.0 and earlier allows attackers to compromise integrity or availability of application via supplying a crafted object (that contains an own property "proto") as an argument to the function. NOTE: the vendor disputes this because the observed behavior only means that a user can create objects that the user didn't know would contain custom prototypes.

Publish Date: 2022-05-10

URL: CVE-2021-42581

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42581

Release Date: 2022-05-10

Fix Resolution: 0.27.1

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.