GitHub Advisoryadvisory · npm

GHSA-52qp-gwwh-qrg4 Missing Handler in @scandipwa/magento-scripts

MEDIUM Published 2021-06-21 Modified 2021-06-16 Official page ↗
Aliases
CVE-2021-32684
Ecosystem
npm
Packages
@scandipwa/magento-scripts
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-670
Reviewed
2021-06-16

Affected packages

• npm @scandipwa/magento-scripts: >= 1.5.1, < 1.5.3 → fixed in 1.5.3

Description

Impact After changing the function from synchronous to asynchronous there wasn't implemented handler in the start, stop, exec and logs commands, effectively making them unusable. Patches Version 1.5.3 contains patches for the problems described above. Workarounds Upgrade to patched or latest (recommended) version `npm i @scandipwa/[email protected]` or `npm i @scandipwa/magento-scripts@latest`. References New releases always available here: https://github.com/scandipwa/create-magento-app/releases For more information If you have any questions or comments about this advisory: • Open an issue in create-magento-app

Related

Alias · CVE (1)

  • CVE-2021-32684 magento-scripts contains scripts and configuration used by Create Magento App, a zero-configuration tool-chain which allows one to deploy… vulnerability

Weakness · CWE (1)

  • CWE-670 Always-Incorrect Control Flow Implementation weakness

References