kijacode / gridfsnodejsfile_upload

This repo show CRUD operation in files with nodejs ,Gridfs and mongodb

GridfsNodejsFile_Upload

This repo show CRUD operation in files with nodejs ,Gridfs and mongodb

gridfsnodejsfile_upload's Issues

CVE-2022-24304 (High) detected in mongoose-5.8.1.tgz - autoclosed

CVE-2022-24304 - High Severity Vulnerability

Vulnerable Library - mongoose-5.8.1.tgz

Mongoose MongoDB ODM

Library home page: https://registry.npmjs.org/mongoose/-/mongoose-5.8.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/mongoose/package.json

Dependency Hierarchy:

• ❌ mongoose-5.8.1.tgz (Vulnerable Library)

Vulnerability Details

Schema in lib/schema.js in Mongoose before 6.4.6 is vulnerable to prototype pollution.

Publish Date: 2022-08-25

URL: CVE-2022-24304

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-08-26

Fix Resolution: 6.4.6

---

Step up your Open Source Security Game with Mend here

CVE-2022-24434 (High) detected in dicer-0.2.5.tgz

CVE-2022-24434 - High Severity Vulnerability

Vulnerable Library - dicer-0.2.5.tgz

A very fast streaming multipart parser for node.js

Library home page: https://registry.npmjs.org/dicer/-/dicer-0.2.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/dicer/package.json

Dependency Hierarchy:

• multer-1.4.2.tgz (Root Library)
  • busboy-0.2.14.tgz
    • ❌ dicer-0.2.5.tgz (Vulnerable Library)

Vulnerability Details

This affects all versions of package dicer. A malicious attacker can send a modified form to server, and crash the nodejs service. An attacker could sent the payload again and again so that the service continuously crashes.

Publish Date: 2022-05-20

URL: CVE-2022-24434

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

---

Step up your Open Source Security Game with Mend here

CVE-2022-2564 (High) detected in mongoose-5.8.1.tgz

CVE-2022-2564 - High Severity Vulnerability

Vulnerable Library - mongoose-5.8.1.tgz

Mongoose MongoDB ODM

Library home page: https://registry.npmjs.org/mongoose/-/mongoose-5.8.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/mongoose/package.json

Dependency Hierarchy:

• ❌ mongoose-5.8.1.tgz (Vulnerable Library)

Vulnerability Details

Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.

Publish Date: 2022-07-28

URL: CVE-2022-2564

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2564

Release Date: 2022-07-28

Fix Resolution: 5.13.15

---

Step up your Open Source Security Game with Mend here

CVE-2019-2391 (Medium) detected in bson-1.1.3.tgz

CVE-2019-2391 - Medium Severity Vulnerability

Vulnerable Library - bson-1.1.3.tgz

A bson parser for node.js and the browser

Library home page: https://registry.npmjs.org/bson/-/bson-1.1.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/bson/package.json

Dependency Hierarchy:

• mongoose-5.8.1.tgz (Root Library)
  • ❌ bson-1.1.3.tgz (Vulnerable Library)

Vulnerability Details

Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure. This issue affects: MongoDB Inc. js-bson library version 1.1.3 and prior to.

Publish Date: 2020-03-31

URL: CVE-2019-2391

CVSS 3 Score Details (5.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2391

Release Date: 2020-09-29

Fix Resolution (bson): 1.1.4

Direct dependency fix Resolution (mongoose): 5.8.2

---

Step up your Open Source Security Game with Mend here

CVE-2021-44906 (High) detected in minimist-0.0.8.tgz

CVE-2021-44906 - High Severity Vulnerability

Vulnerable Library - minimist-0.0.8.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/minimist/package.json

Dependency Hierarchy:

• multer-1.4.2.tgz (Root Library)
  • mkdirp-0.5.1.tgz
    • ❌ minimist-0.0.8.tgz (Vulnerable Library)

Vulnerability Details

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

Publish Date: 2022-03-17

URL: CVE-2021-44906

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-03-17

Fix Resolution (minimist): 1.2.6

Direct dependency fix Resolution (multer): 1.4.4-lts.1

---

Step up your Open Source Security Game with Mend here

CVE-2020-7610 (High) detected in bson-1.1.3.tgz

CVE-2020-7610 - High Severity Vulnerability

Vulnerable Library - bson-1.1.3.tgz

A bson parser for node.js and the browser

Library home page: https://registry.npmjs.org/bson/-/bson-1.1.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/bson/package.json

Dependency Hierarchy:

• mongoose-5.8.1.tgz (Root Library)
  • ❌ bson-1.1.3.tgz (Vulnerable Library)

Vulnerability Details

All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsotype, leading to cases where an object is serialized as a document rather than the intended BSON type.

Publish Date: 2020-03-30

URL: CVE-2020-7610

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-04-01

Fix Resolution (bson): 1.1.4

Direct dependency fix Resolution (mongoose): 5.8.2

---

Step up your Open Source Security Game with Mend here

CVE-2020-7598 (Medium) detected in minimist-0.0.8.tgz

CVE-2020-7598 - Medium Severity Vulnerability

Vulnerable Library - minimist-0.0.8.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/minimist/package.json

Dependency Hierarchy:

• multer-1.4.2.tgz (Root Library)
  • mkdirp-0.5.1.tgz
    • ❌ minimist-0.0.8.tgz (Vulnerable Library)

Vulnerability Details

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "proto" payload.

Publish Date: 2020-03-11

URL: CVE-2020-7598

CVSS 3 Score Details (5.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-03-11

Fix Resolution (minimist): 0.2.1

Direct dependency fix Resolution (multer): 1.4.3

---

Step up your Open Source Security Game with Mend here

CVE-2021-23438 (High) detected in mpath-0.6.0.tgz

CVE-2021-23438 - High Severity Vulnerability

Vulnerable Library - mpath-0.6.0.tgz

{G,S}et object values using MongoDB-like path notation

Library home page: https://registry.npmjs.org/mpath/-/mpath-0.6.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/mpath/package.json

Dependency Hierarchy:

• mongoose-5.8.1.tgz (Root Library)
  • ❌ mpath-0.6.0.tgz (Vulnerable Library)

Vulnerability Details

This affects the package mpath before 0.8.4. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condition ignoreProperties.indexOf(parts[i]) !== -1 returns -1 if parts[i] is ['proto']. This is because the method that has been called if the input is an array is Array.prototype.indexOf() and not String.prototype.indexOf(). They behave differently depending on the type of the input.

Publish Date: 2021-09-01

URL: CVE-2021-23438

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23438

Release Date: 2021-09-01

Fix Resolution (mpath): 0.8.4

Direct dependency fix Resolution (mongoose): 5.13.9

---

Step up your Open Source Security Game with Mend here

CVE-2020-35149 (Medium) detected in mquery-3.2.2.tgz

CVE-2020-35149 - Medium Severity Vulnerability

Vulnerable Library - mquery-3.2.2.tgz

Expressive query building for MongoDB

Library home page: https://registry.npmjs.org/mquery/-/mquery-3.2.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/mquery/package.json

Dependency Hierarchy:

• mongoose-5.8.1.tgz (Root Library)
  • ❌ mquery-3.2.2.tgz (Vulnerable Library)

Vulnerability Details

lib/utils.js in mquery before 3.2.3 allows a pollution attack because a special property (e.g., proto) can be copied during a merge or clone operation.

Publish Date: 2020-12-11

URL: CVE-2020-35149

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-12-11

Fix Resolution (mquery): 3.2.3

Direct dependency fix Resolution (mongoose): 5.11.7

---

Step up your Open Source Security Game with Mend here