CVE-2020-15095

Aliases:GHSA-93f3-23rq-pjfp
Advisory lineage Upstream: 0 Downstream: 17
Modified
Published: 07 Jul 2020, 18:55
Last modified:04 Aug 2024, 13:08

Vulnerability Summary

Overall Risk (default)
low
18/100
CVSS Score
4.4 MEDIUM
v3.1 (cve.org)
EPSS Score
0.13% LOW
0% probability +0.03%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

07 Jul 2020, 18:55
Published
Vulnerability first disclosed
04 Aug 2024, 13:08
Last Modified
Vulnerability information updated

Description

Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>". The password value is not redacted and is printed to stdout and also to any generated log files.

CVSS Metrics

  • v3.1•MEDIUM•Score: 4.4CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
  • v2.0•LOW•Score: 1.9AV:L/AC:M/Au:N/C:P/I:N/A:N

EPSS Trends

Current EPSS score: 0.13%• Percentile: 32%

Techniques & Countermeasures

  • CWE-532•Insertion of Sensitive Information into Log File

    The product writes sensitive information to a log file.

Affected Systems

  • fedoraproject•fedora

    33

  • npm•cli

    < 6.14.6

  • Npm•npm

    < 6.14.6

  • npmjs•npm

    < 6.14.6

  • opensuse•leap

    15.1 | 15.2

References (10)