GitHub Advisoryadvisory · npm

GHSA-93f3-23rq-pjfp npm CLI exposing sensitive information through logs

MEDIUM Published 2020-07-07 Modified 2022-08-10 Official page ↗
Aliases
CVE-2020-15095
Ecosystem
npm
Packages
npm
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
Weaknesses
CWE-532
Reviewed
2020-07-07

Affected packages

• npm npm: < 6.14.6 → fixed in 6.14.6

Description

Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like `://[[:]@][:][:][/]`. The password value is not redacted and is printed to stdout and also to any generated log files.

Related

Alias · CVE (1)

  • CVE-2020-15095 Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. vulnerability

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References