// For flags

CVE-2019-16776

Unauthorized File Access in npm CLI before before version 6.13.3

Severity Score

8.1
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or gain access to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

Las versiones del npm CLI en versiones anteriores a la 6.13.3 son vulnerables a una escritura de archivo arbitraria. No puede evitar el acceso a las carpetas fuera de la carpeta node_modules prevista a través del campo bin. Una entrada construida correctamente en el campo bin de package.json permitiría al editor del paquete modificar y/o acceder a archivos arbitrarios en el sistema de un usuario cuando el paquete esté instalado. Este comportamiento aún es posible mediante scripts de instalación. Esta vulnerabilidad evita que un usuario utilice la opción de instalación --ignore-scripts.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
None
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Partial
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2019-09-24 CVE Reserved
  • 2019-12-13 CVE Published
  • 2023-11-02 EPSS Updated
  • 2024-08-05 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-20: Improper Input Validation
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Npmjs
Search vendor "Npmjs"
 Npm
Search vendor "Npmjs" for product "Npm"
 < 6.13.3
Search vendor "Npmjs" for product "Npm" and version " < 6.13.3"
-
Affected
Opensuse
Search vendor "Opensuse"
 Leap
Search vendor "Opensuse" for product "Leap"
 15.1
Search vendor "Opensuse" for product "Leap" and version "15.1"
-
Affected
Oracle
Search vendor "Oracle"
 Graalvm
Search vendor "Oracle" for product "Graalvm"
 19.3.0.2
Search vendor "Oracle" for product "Graalvm" and version "19.3.0.2"
enterprise
Affected
Fedoraproject
Search vendor "Fedoraproject"
 Fedora
Search vendor "Fedoraproject" for product "Fedora"
 31
Search vendor "Fedoraproject" for product "Fedora" and version "31"
-
Affected
Redhat
Search vendor "Redhat"
 Enterprise Linux
Search vendor "Redhat" for product "Enterprise Linux"
 8.0
Search vendor "Redhat" for product "Enterprise Linux" and version "8.0"
-
Affected
Redhat
Search vendor "Redhat"
 Enterprise Linux Eus
Search vendor "Redhat" for product "Enterprise Linux Eus"
 8.1
Search vendor "Redhat" for product "Enterprise Linux Eus" and version "8.1"
-
Affected