CVE-2019-16777

 

Published at: - 13-12-2019 02:15

Last modified: - 02-08-2022 10:45

Total changes: - 2

Description

Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequent installs of packages that also create a serve binary would overwrite the previous serve binary. This behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

 

Verification logic

 

Reference

• https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli
• https://github.com/npm/cli/security/advisories/GHSA-4328-8hgf-7wjr
• openSUSE-SU-2020:0059-Mailing List, Third Party Advisory
• https://www.oracle.com/security-alerts/cpujan2020.html
• FEDORA-2020-595ce5e3cc-Third Party Advisory
• RHEA-2020:0330-Third Party Advisory
• RHSA-2020:0573-Third Party Advisory
• RHSA-2020:0579-Third Party Advisory
• RHSA-2020:0597-Third Party Advisory
• RHSA-2020:0602-Third Party Advisory
• GLSA-202003-48-Third Party Advisory

 

Keywords

NVD

 

CVE-2019-16777

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures