CVE-2021-23440 (Critical) detected in set-value-2.0.0.tgz, set-value-0.4.3.tgz
mend-bolt-for-github opened this issue · comments
CVE-2021-23440 - Critical Severity Vulnerability
Vulnerable Libraries - set-value-2.0.0.tgz, set-value-0.4.3.tgz
set-value-2.0.0.tgz
Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.
Library home page: https://registry.npmjs.org/set-value/-/set-value-2.0.0.tgz
Path to dependency file: /Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/package.json
Path to vulnerable library: /Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/set-value/package.json,/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/set-value/package.json,/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/set-value/package.json,/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/set-value/package.json,/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/set-value/package.json,/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/set-value/package.json,/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/set-value/package.json,/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/set-value/package.json,/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/set-value/package.json,/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/set-value/package.json,/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/set-value/package.json,/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/set-value/package.json
Dependency Hierarchy:
- react-scripts-1.1.4.tgz (Root Library)
- babel-jest-20.0.3.tgz
- babel-plugin-istanbul-4.1.6.tgz
- test-exclude-4.2.1.tgz
- micromatch-3.1.10.tgz
- snapdragon-0.8.2.tgz
- base-0.11.2.tgz
- cache-base-1.0.1.tgz
- ❌ set-value-2.0.0.tgz (Vulnerable Library)
- cache-base-1.0.1.tgz
- base-0.11.2.tgz
- snapdragon-0.8.2.tgz
- micromatch-3.1.10.tgz
- test-exclude-4.2.1.tgz
- babel-plugin-istanbul-4.1.6.tgz
- babel-jest-20.0.3.tgz
set-value-0.4.3.tgz
Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.
Library home page: https://registry.npmjs.org/set-value/-/set-value-0.4.3.tgz
Path to dependency file: /Section27-State/update-complex-state/package.json
Path to vulnerable library: /Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/union-value/node_modules/set-value/package.json,/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/union-value/node_modules/set-value/package.json,/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/union-value/node_modules/set-value/package.json,/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/union-value/node_modules/set-value/package.json,/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/union-value/node_modules/set-value/package.json,/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/union-value/node_modules/set-value/package.json,/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/union-value/node_modules/set-value/package.json,/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/union-value/node_modules/set-value/package.json,/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/union-value/node_modules/set-value/package.json,/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/union-value/node_modules/set-value/package.json,/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/union-value/node_modules/set-value/package.json,/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/union-value/node_modules/set-value/package.json
Dependency Hierarchy:
- react-scripts-1.1.4.tgz (Root Library)
- babel-jest-20.0.3.tgz
- babel-plugin-istanbul-4.1.6.tgz
- test-exclude-4.2.1.tgz
- micromatch-3.1.10.tgz
- snapdragon-0.8.2.tgz
- base-0.11.2.tgz
- cache-base-1.0.1.tgz
- union-value-1.0.0.tgz
- ❌ set-value-0.4.3.tgz (Vulnerable Library)
- union-value-1.0.0.tgz
- cache-base-1.0.1.tgz
- base-0.11.2.tgz
- snapdragon-0.8.2.tgz
- micromatch-3.1.10.tgz
- test-exclude-4.2.1.tgz
- babel-plugin-istanbul-4.1.6.tgz
- babel-jest-20.0.3.tgz
Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4
Found in base branch: master
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://www.huntr.dev/bounties/2eae1159-01de-4f82-a177-7478a408c4a2/
Release Date: 2021-09-12
Fix Resolution (set-value): 2.0.1
Direct dependency fix Resolution (react-scripts): 1.1.5
Fix Resolution (set-value): 2.0.1
Direct dependency fix Resolution (react-scripts): 1.1.5
Step up your Open Source Security Game with Mend here