Description

This affects all versions of package calipso. It is possible for a malicious module to overwrite files on an arbitrary file system through the module install functionality.

Remediation

References

https://github.com/cliftonc/calipso

https://snyk.io/vuln/SNYK-JS-CALIPSO-1300555

Related Vulnerabilities

CVE-2016-10735 Vulnerability in maven package org.webjars.bowergithub.twbs:bootstrap-sass

CVE-2020-1745 Vulnerability in maven package io.undertow:undertow-core

CVE-2019-10289 Vulnerability in maven package org.jenkins-ci.plugins:netsparker-cloud-scan

CVE-2023-28155 Vulnerability in maven package org.webjars.bower:request

CVE-2021-21252 Vulnerability in maven package org.webjars.bowergithub.jquery-validation:jquery-validation

Severity

High

Classification

CWE-22 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Tags

Third Party Advisory Exploit