You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Path to dependency file: /tmp/archiveExtraction_9bd63957-1183-446b-bed6-ebbc81a77318/20200315073038_27966/ws-scm_depth_0/cesium-coreui-react/frontend/public/Cesium-1.61/package.json
Path to vulnerable library: /tmp/ws-scm/cesium-coreui-react/frontend/node_modules/sass-graph/node_modules/yargs-parser/package.json,/tmp/ws-scm/cesium-coreui-react/frontend/node_modules/sass-graph/node_modules/yargs-parser/package.json
Path to dependency file: /tmp/ws-scm/cesium-coreui-react/frontend/package.json
Path to vulnerable library: /tmp/ws-scm/cesium-coreui-react/node_modules/yargs-parser/package.json,/tmp/ws-scm/cesium-coreui-react/node_modules/yargs-parser/package.json
CVE-2020-7608 - Medium Severity Vulnerability
Vulnerable Libraries - yargs-parser-13.1.1.tgz, yargs-parser-5.0.0.tgz, yargs-parser-11.1.1.tgz
yargs-parser-13.1.1.tgz
the mighty option parser used by yargs
Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-13.1.1.tgz
Path to dependency file: /tmp/ws-scm/cesium-coreui-react/frontend/package.json
Path to vulnerable library: /tmp/ws-scm/cesium-coreui-react/frontend/node_modules/yargs-parser/package.json
Dependency Hierarchy:
yargs-parser-5.0.0.tgz
the mighty option parser used by yargs
Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-5.0.0.tgz
Path to dependency file: /tmp/archiveExtraction_9bd63957-1183-446b-bed6-ebbc81a77318/20200315073038_27966/ws-scm_depth_0/cesium-coreui-react/frontend/public/Cesium-1.61/package.json
Path to vulnerable library: /tmp/ws-scm/cesium-coreui-react/frontend/node_modules/sass-graph/node_modules/yargs-parser/package.json,/tmp/ws-scm/cesium-coreui-react/frontend/node_modules/sass-graph/node_modules/yargs-parser/package.json
Dependency Hierarchy:
yargs-parser-11.1.1.tgz
the mighty option parser used by yargs
Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-11.1.1.tgz
Path to dependency file: /tmp/ws-scm/cesium-coreui-react/frontend/package.json
Path to vulnerable library: /tmp/ws-scm/cesium-coreui-react/node_modules/yargs-parser/package.json,/tmp/ws-scm/cesium-coreui-react/node_modules/yargs-parser/package.json
Dependency Hierarchy:
Found in HEAD commit: 20577fde3f70c867aeddde46e9305b9c36738f9a
Vulnerability Details
yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload.
Publish Date: 2020-03-16
URL: CVE-2020-7608
CVSS 3 Score Details (5.0)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7608
Release Date: 2020-03-16
Fix Resolution: v18.1.1;13.1.2;15.0.1
Step up your Open Source Security Game with WhiteSource here
The text was updated successfully, but these errors were encountered: