express-fileupload-0.0.5.tgz: 3 vulnerabilities (highest severity is: 9.8)

[mend-for-github-com]

Vulnerable Library - express-fileupload-0.0.5.tgz

Simple express file upload middleware that wraps around connect-busboy

Library home page: https://registry.npmjs.org/express-fileupload/-/express-fileupload-0.0.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/express-fileupload/package.json

Found in HEAD commit: a1054901076ba8d51b417c27b922cc129f9747dd

Mend has checked all newer package trees, and you are on the least vulnerable package!

Please note: There might be a version that explicitly solves one or more of the vulnerabilities listed below, but we do not recommend it. For more info about the optional fixes, check the section “Details” below.

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (express-fileupload version)	Fix PR available
CVE-2020-7699	High	9.8	express-fileupload-0.0.5.tgz	Direct	N/A	❌
CVE-2022-27261	High	7.5	express-fileupload-0.0.5.tgz	Direct	N/A	❌
WS-2019-0314	Medium	5.3	express-fileupload-0.0.5.tgz	Direct	N/A	❌

Details

CVE-2020-7699

Vulnerable Library - express-fileupload-0.0.5.tgz

Simple express file upload middleware that wraps around connect-busboy

Library home page: https://registry.npmjs.org/express-fileupload/-/express-fileupload-0.0.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/express-fileupload/package.json

Dependency Hierarchy:

• ❌ express-fileupload-0.0.5.tgz (Vulnerable Library)

Found in HEAD commit: a1054901076ba8d51b417c27b922cc129f9747dd

Found in base branch: main

Vulnerability Details

This affects the package express-fileupload before 1.1.8. If the parseNested option is enabled, sending a corrupt HTTP request can lead to denial of service or arbitrary code execution.

Publish Date: 2020-07-30

URL: CVE-2020-7699

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-07-30

Fix Resolution: 1.1.8

In order to enable automatic remediation, please create workflow rules

CVE-2022-27261

Vulnerable Library - express-fileupload-0.0.5.tgz

Simple express file upload middleware that wraps around connect-busboy

Library home page: https://registry.npmjs.org/express-fileupload/-/express-fileupload-0.0.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/express-fileupload/package.json

Dependency Hierarchy:

• ❌ express-fileupload-0.0.5.tgz (Vulnerable Library)

Found in HEAD commit: a1054901076ba8d51b417c27b922cc129f9747dd

Found in base branch: main

Vulnerability Details

An arbitrary file write vulnerability in Express-FileUpload v1.3.1 allows attackers to upload multiple files with the same name, causing an overwrite of files in the web application server.

Publish Date: 2022-04-12

URL: CVE-2022-27261

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

WS-2019-0314

Vulnerable Library - express-fileupload-0.0.5.tgz

Simple express file upload middleware that wraps around connect-busboy

Library home page: https://registry.npmjs.org/express-fileupload/-/express-fileupload-0.0.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/express-fileupload/package.json

Dependency Hierarchy:

• ❌ express-fileupload-0.0.5.tgz (Vulnerable Library)

Found in HEAD commit: a1054901076ba8d51b417c27b922cc129f9747dd

Found in base branch: main

Vulnerability Details

In "richardgirges/express-fileupload", versions prior to v1.1.6-alpha.6 are vulnerable to DOS, as a result of an unparsed file name.

Publish Date: 2019-10-18

URL: WS-2019-0314

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1216

Release Date: 2019-10-18

Fix Resolution: express-fileupload - 1.1.6-alpha.6

In order to enable automatic remediation, please create workflow rules