CVE-2020-15095
Sensitive information exposure through logs in npm cli
MEDIUM 4.4EPSS 0.4%
Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>". The password value is not redacted and is printed to stdout and also to any generated log files.
- Affected
- npm · cli
- CVSS v3.1 NVD
- 4.4 MEDIUM
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N - CVSS v2.0 NVD
- 1.9 LOW
AV:L/AC:M/Au:N/C:P/I:N/A:N - EPSS
- 0.40% chance of exploitation in the next 30 days, 33rd percentile
- Published
- 2020-07-07
- Updated
- 2024-08-04
Proof-of-concept exploits (1)
- ossf-cve-benchmark/CVE-2020-150950★ · 2020-12-01
Security advisories
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00015.html
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00023.html
- npm/cli/blob/66aab417f836a901f8afb265251f761bb0422463/CHANGELOG.md#6146-2020-07-07
- npm/cli/security/advisories/GHSA-93f3-23rq-pjfp
- https://security.gentoo.org/glsa/202101-07
- advisories/GHSA-93f3-23rq-pjfp