Home

CVE-2019-16777

Description

Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequent installs of packages that also create a serve binary would overwrite the previous serve binary. This behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

Risk Information

Base Score
6.5
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
EPSS Score
Exploitation Probability
0.352

Associated Vulnerability

VulnerabilityOS Platform
(RHSA-2020:0579)Important: security update nodejs-10.19.0-1.module+el8.1.0+5726+6ed65f8c.x86_64.rpmLinux
(RHSA-2020:0579)Important: security update nodejs-debuginfo-10.19.0-1.module+el8.1.0+5726+6ed65f8c.x86_64.rpmLinux
(RHSA-2020:0579)Important: security update nodejs-debugsource-10.19.0-1.module+el8.1.0+5726+6ed65f8c.x86_64.rpmLinux
(RHSA-2020:0579)Important: security update nodejs-devel-10.19.0-1.module+el8.1.0+5726+6ed65f8c.x86_64.rpmLinux
(RHSA-2020:0579)Important: security update nodejs-devel-debuginfo-10.19.0-1.module+el8.1.0+5726+6ed65f8c.x86_64.rpmLinux
(RHSA-2020:0579)Important: security update nodejs-docs-10.19.0-1.module+el8.1.0+5726+6ed65f8c.noarch.rpmLinux
(RHSA-2020:0579)Important: security update nodejs-nodemon-1.18.3-1.module+el8+2632+6c5111ed.noarch.rpmLinux
(RHSA-2020:0579)Important: security update nodejs-packaging-17-3.module+el8+2873+aa7dfd9a.noarch.rpmLinux
(RHSA-2020:0579)Important: security update npm-6.13.4-1.10.19.0.1.module+el8.1.0+5726+6ed65f8c.x86_64.rpmLinux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234