CVE-2020-15095

Description

From CVE.org

Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>". The password value is not redacted and is printed to stdout and also to any generated log files.

Mitigation

Do not provide a password to npm via the cli to avoid it from being entered into the logs and stdout, or use ssh instead.

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

CVSS v3 Score Breakdown

Red HatNVDcve.org
Base Score4.44.4N/A
Attack VectorLocalLocalN/A
Attack ComplexityHighHighN/A
Privileges RequiredLowLowN/A
User InteractionRequiredRequiredN/A
ScopeUnchangedUnchangedN/A
ConfidentialityHighHighN/A
Integrity ImpactNoneNoneN/A
Availability ImpactNoneNoneN/A

Vector

Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

NVD: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

Red Hat CVSS v3 Score Explanation

Marked AC:H because the attacker first needs the victim to actually be using this URL format which may not be the most common, and also they need access to the log files. Neither of these things are in the attacker's control.

UI:R because the description states: "The CLI supports URLs like "://[[:]@][:][:][/]". The password value is not redacted and is printed to stdout and also to any generated log files." which means there must be user interaction on the CLI to trigger this. This attack wouldn't occur from simply having npm installed and/or running.

Understanding the Weakness (CWE)

CWE-532

Confidentiality

Technical Impact: Read Application Data

Logging sensitive user data, full path names, or system information often provides attackers with an additional, less-protected path to acquiring the information.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.