You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The package node-cli before 1.0.0 insecurely uses the lock_file and log_file. Both of these are temporary, but it allows the starting user to overwrite any file they have access to.
CVE-2016-10538 - Low Severity Vulnerability
Vulnerable Library - cli-0.4.5.tgz
A tool for rapidly building command line apps
path: /tmp/git/jenkins-material-theme/node_modules/cli/package.json
Library home page: http://registry.npmjs.org/cli/-/cli-0.4.5.tgz
Dependency Hierarchy:
Vulnerability Details
The package
node-cli
before 1.0.0 insecurely uses the lock_file and log_file. Both of these are temporary, but it allows the starting user to overwrite any file they have access to.Publish Date: 2018-05-31
URL: CVE-2016-10538
CVSS 3 Score Details (3.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://nodesecurity.io/advisories/95
Release Date: 2016-06-15
Fix Resolution: Update to version 1.0.0 or later.
Step up your Open Source Security Game with WhiteSource here
The text was updated successfully, but these errors were encountered: