Description

Improper Removal of Sensitive Information Before Storage or Transfer in NPM simple-get prior to 4.0.1.

Remediation

References

https://github.com/feross/simple-get/commit/e4af095e06cd69a9235013e8507e220a79b9684f

https://huntr.dev/bounties/42c79c23-6646-46c4-871d-219c0d4b4e31

https://github.com/advisories/GHSA-wpg7-2c88-r8xv

Related Vulnerabilities

CVE-2017-5651 Vulnerability in maven package org.apache.tomcat:tomcat-coyote

CVE-2023-30519 Vulnerability in maven package org.jenkins-ci.plugins:quayio-trigger

CVE-2021-23507 Vulnerability in npm package object-path-set

CVE-2022-25647 Vulnerability in maven package com.google.code.gson:gson

CVE-2018-7651 Vulnerability in npm package ssri

Severity

High

Classification

CWE-212 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Patch Third Party Advisory Exploit