CVE-2020-15095mediumCWE-532

CVE-2020-15095: medium-severity vulnerability in npm cli

Sensitive information exposure through logs in npm cli

Published · Updated

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.4epss 0.4%
exploitation probability
0.4%top 67% of all CVEs
observed exploitation
nono source reports it
Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>". The password value is not redacted and is printed to stdout and also to any generated log files.
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
Affected products
npm · cli
Related CVEs — npm cli

In the same product, most dangerous first.

CVE-2019-16776HIGHUnauthorized File Access in npm CLI before before version 6.13.3EPSS 3.4%CVE-2019-16775HIGHUnauthorized File Access in npm CLI before before version 6.13.3EPSS 3.3%CVE-2019-16777HIGHArbitrary File Overwrite in npm CLIEPSS 2.1%CVE-2026-0775HIGHnpm cli Incorrect Permission Assignment Local Privilege Escalation VulnerabilityEPSS 0.3%
References
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00011.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-10/msg00015.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-10/msg00023.htmlhttps://github.com/npm/cli/blob/66aab417f836a901f8afb265251f761bb0422463/CHANGELOG.md#6146-2020-07-07https://github.com/npm/cli/commit/a9857b8f6869451ff058789c4631fadfde5bbcbchttps://github.com/npm/cli/security/advisories/GHSA-93f3-23rq-pjfphttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/https://security.gentoo.org/glsa/202101-07