next-20.0.11.tgz: 2 vulnerabilities (highest severity is: 7.5) - autoclosed

[mend-bolt-for-github]

Vulnerable Library - next-20.0.11.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Found in HEAD commit: c4147e953d36d979717a037fff1398f5e4f4d7e3

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (next version)	Remediation Possible**
CVE-2024-21536	High	7.5	http-proxy-middleware-2.0.6.tgz	Transitive	N/A*	❌
CVE-2024-43788	Medium	6.4	webpack-5.93.0.tgz	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-21536

Vulnerable Library - http-proxy-middleware-2.0.6.tgz

The one-liner node.js proxy middleware for connect, express and browser-sync

Library home page: https://registry.npmjs.org/http-proxy-middleware/-/http-proxy-middleware-2.0.6.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• next-20.0.11.tgz (Root Library)
  • webpack-20.0.11.tgz
    • webpack-dev-server-5.0.4.tgz
      • ❌ http-proxy-middleware-2.0.6.tgz (Vulnerable Library)

Found in HEAD commit: c4147e953d36d979717a037fff1398f5e4f4d7e3

Found in base branch: main

Vulnerability Details

Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths.

Publish Date: 2024-10-19

URL: CVE-2024-21536

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-21536

Release Date: 2024-10-19

Fix Resolution: http-proxy-middleware - 2.0.7,3.0.3

Step up your Open Source Security Game with Mend here

CVE-2024-43788

Vulnerable Library - webpack-5.93.0.tgz

Library home page: https://registry.npmjs.org/webpack/-/webpack-5.93.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• next-20.0.11.tgz (Root Library)
  • webpack-20.0.11.tgz
    • ❌ webpack-5.93.0.tgz (Vulnerable Library)

Found in HEAD commit: c4147e953d36d979717a037fff1398f5e4f4d7e3

Found in base branch: main

Vulnerability Details

Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, bundling, or packaging just about any resource or asset. The webpack developers have discovered a DOM Clobbering vulnerability in Webpack’s AutoPublicPathRuntimeModule. The DOM Clobbering gadget in the module can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an img tag with an unsanitized name attribute) are present. Real-world exploitation of this gadget has been observed in the Canvas LMS which allows a XSS attack to happen through a javascript code compiled by Webpack (the vulnerable part is from Webpack). DOM Clobbering is a type of code-reuse attack where the attacker first embeds a piece of non-script, seemingly benign HTML markups in the webpage (e.g. through a post or comment) and leverages the gadgets (pieces of js code) living in the existing javascript code to transform it into executable code. This vulnerability can lead to cross-site scripting (XSS) on websites that include Webpack-generated files and allow users to inject certain scriptless HTML tags with improperly sanitized name or id attributes. This issue has been addressed in release version 5.94.0. All users are advised to upgrade. There are no known workarounds for this issue.

Publish Date: 2024-08-27

URL: CVE-2024-43788

CVSS 3 Score Details (6.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-4vvj-4cpr-p986

Release Date: 2024-08-27

Fix Resolution: webpack - 5.94.0

Step up your Open Source Security Game with Mend here

[mend-bolt-for-github]

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.