passport-windowsauth@0.4.1

Vulnerabilities

 1 via 2 paths

Dependencies

 19

Source

 npm
Find a vulnerability free version of passport-windowsauth | View passport-windowsauth package health on Snyk Advisor

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 1
Status
  • 1
  • 0
  • 0

medium severity

Remote Code Execution (RCE)

  • Vulnerable module: bunyan
  • Introduced through: ldapjs@0.7.1

Detailed paths

  • Introduced through: passport-windowsauth@0.4.1 › ldapjs@0.7.1 › bunyan@0.22.1
    Remediation: Upgrade to passport-windowsauth@1.0.0.
  • Introduced through: passport-windowsauth@0.4.1 › ldapjs@0.7.1 › pooling@0.4.6 › bunyan@0.22.1

Overview

bunyan is an a JSON logging library for node.js services

Affected versions of this package are vulnerable to Remote Code Execution (RCE) via insecure command formatting which allowed creating a "hacked" file in the current dir.

Remediation

Upgrade bunyan to version 1.8.13, 2.0.3 or higher.

References

Remote Code Execution (RCE) vulnerability report