openapi-examples-validator-4.6.0.tgz: 3 vulnerabilities (highest severity is: 9.8)

[mend-for-github-com]

Vulnerable Library - openapi-examples-validator-4.6.0.tgz

Path to dependency file: /api-docs/package.json

Path to vulnerable library: /api-docs/package.json

Found in HEAD commit: 12c2455088329534a8c99aac9ba0789fc50d7606

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (openapi-examples-validator version)	Remediation Possible**
CVE-2024-21534	Critical	9.8	jsonpath-plus-6.0.1.tgz	Transitive	N/A*	❌
CVE-2022-4742	Medium	6.3	json-pointer-0.6.1.tgz	Transitive	4.7.0	✅
CVE-2021-23820	Medium	5.6	json-pointer-0.6.1.tgz	Transitive	4.7.0	✅

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-21534

Vulnerable Library - jsonpath-plus-6.0.1.tgz

A JS implementation of JSONPath with some additional operators

Library home page: https://registry.npmjs.org/jsonpath-plus/-/jsonpath-plus-6.0.1.tgz

Path to dependency file: /api-docs/package.json

Path to vulnerable library: /api-docs/package.json

Dependency Hierarchy:

• openapi-examples-validator-4.6.0.tgz (Root Library)
  • ❌ jsonpath-plus-6.0.1.tgz (Vulnerable Library)

Found in HEAD commit: 12c2455088329534a8c99aac9ba0789fc50d7606

Found in base branch: master

Vulnerability Details

All versions of the package jsonpath-plus are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of vm in Node. Note: There were several attempts to fix it in versions 10.0.0-10.1.0 but it could still be exploited using different payloads.

Publish Date: 2024-10-11

URL: CVE-2024-21534

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-21534

Release Date: 2024-10-11

Fix Resolution: jsonpath-plus - 10.2.0

CVE-2022-4742

Vulnerable Library - json-pointer-0.6.1.tgz

Some utilities for JSON pointers described by RFC 6901

Library home page: https://registry.npmjs.org/json-pointer/-/json-pointer-0.6.1.tgz

Path to dependency file: /api-docs/package.json

Path to vulnerable library: /api-docs/package.json

Dependency Hierarchy:

• openapi-examples-validator-4.6.0.tgz (Root Library)
  • ❌ json-pointer-0.6.1.tgz (Vulnerable Library)

Found in HEAD commit: 12c2455088329534a8c99aac9ba0789fc50d7606

Found in base branch: master

Vulnerability Details

A vulnerability, which was classified as critical, has been found in json-pointer up to 0.6.1. Affected by this issue is the function set of the file index.js. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack may be launched remotely. Upgrading to version 0.6.2 is able to address this issue. The patch is identified as 859c9984b6c407fc2d5a0a7e47c7274daa681941. It is recommended to upgrade the affected component. VDB-216794 is the identifier assigned to this vulnerability.

Publish Date: 2022-12-26

URL: CVE-2022-4742

CVSS 3 Score Details (6.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/package/json-pointer?activeTab=versions

Release Date: 2022-12-26

Fix Resolution (json-pointer): 0.6.2

Direct dependency fix Resolution (openapi-examples-validator): 4.7.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-23820

Vulnerable Library - json-pointer-0.6.1.tgz

Some utilities for JSON pointers described by RFC 6901

Library home page: https://registry.npmjs.org/json-pointer/-/json-pointer-0.6.1.tgz

Path to dependency file: /api-docs/package.json

Path to vulnerable library: /api-docs/package.json

Dependency Hierarchy:

• openapi-examples-validator-4.6.0.tgz (Root Library)
  • ❌ json-pointer-0.6.1.tgz (Vulnerable Library)

Found in HEAD commit: 12c2455088329534a8c99aac9ba0789fc50d7606

Found in base branch: master

Vulnerability Details

This affects all versions of package json-pointer. A type confusion vulnerability can lead to a bypass of CVE-2020-7709 when the pointer components are arrays.

Publish Date: 2021-11-03

URL: CVE-2021-23820

CVSS 3 Score Details (5.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-23820

Release Date: 2021-11-03

Fix Resolution (json-pointer): 0.6.2

Direct dependency fix Resolution (openapi-examples-validator): 4.7.0

⛑️ Automatic Remediation will be attempted for this issue.

---

⛑️Automatic Remediation will be attempted for this issue.