Home

CVE-2020-15095

Description

Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like ://[[:]@][:][:][/]. The password value is not redacted and is printed to stdout and also to any generated log files.

Risk Information

Base Score
4.4
MODERATE
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
EPSS Score
Exploitation Probability
0.1

Associated Vulnerability

VulnerabilityOS Platform
(RHSA-2020:4272) nodejs:12 security and bug fix update nodejs-12.18.4-2.module+el8.2.0+8361+192e434e.x86_64.rpmLinux
(RHSA-2020:4272) nodejs:12 security and bug fix update nodejs-debugsource-12.18.4-2.module+el8.2.0+8361+192e434e.x86_64.rpmLinux
(RHSA-2020:4272) nodejs:12 security and bug fix update nodejs-devel-12.18.4-2.module+el8.2.0+8361+192e434e.x86_64.rpmLinux
(RHSA-2020:4272) nodejs:12 security and bug fix update nodejs-docs-12.18.4-2.module+el8.2.0+8361+192e434e.noarch.rpmLinux
(RHSA-2020:4272) nodejs:12 security and bug fix update nodejs-full-i18n-12.18.4-2.module+el8.2.0+8361+192e434e.x86_64.rpmLinux
(RHSA-2020:4272) nodejs:12 security and bug fix update npm-6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e.x86_64.rpmLinux
(RHSA-2021:0548)Moderate: security update nodejs-10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64.rpmLinux
(RHSA-2021:0548)Moderate: security update nodejs-debuginfo-10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64.rpmLinux
(RHSA-2021:0548)Moderate: security update nodejs-debugsource-10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64.rpmLinux
(RHSA-2021:0548)Moderate: security update nodejs-devel-10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64.rpmLinux
(RHSA-2021:0548)Moderate: security update nodejs-docs-10.23.1-1.module+el8.3.0+9502+012d8a97.noarch.rpmLinux
(RHSA-2021:0548)Moderate: security update nodejs-full-i18n-10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64.rpmLinux
(RHSA-2021:0548)Moderate: security update nodejs-nodemon-1.18.3-1.module+el8+2632+6c5111ed.noarch.rpmLinux
(RHSA-2021:0548)Moderate: security update nodejs-packaging-17-3.module+el8+2873+aa7dfd9a.noarch.rpmLinux
(RHSA-2021:0548)Moderate: security update npm-6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.x86_64.rpmLinux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234