CVE-2023-45857 - Medium Severity Vulnerability

[dvasilen]

CVE-2023-45857 - Medium Severity Vulnerability

Vulnerable Library - axios-1.5.1.tgz

Library home page: https://registry.npmjs.org/axios/-/axios-1.5.1.tgz

Dependency Hierarchy:

• winston-slack-webhook-transport-2.3.2.tgz (Root Library)
  • ❌ axios-1.5.1.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.

Publish Date: 2023-11-08

URL: CVE-2023-45857

CVSS 3 Score Details (5.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: axios/axios#6006

Release Date: 2023-11-08

Fix Resolution: axios - 1.6.0

[dvasilen]

Please update axios dependency to 1.6.0

[dvasilen]

See #30

[TheAppleFreak]

I'll do a full set of updates once I get to my computer.

…

On Sat, Nov 11, 2023 at 10:36 AM Dmitry Vasilenko ***@***.***> wrote: See #30 <#30> — Reply to this email directly, view it on GitHub <#31 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AASMG3GFCW2CJRABPFDUDGDYD6LPXAVCNFSM6AAAAAA7HKS2KWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTQMBWHA2DMNBSHA> . You are receiving this because you are subscribed to this thread.Message ID: <TheAppleFreak/winston-slack-webhook-transport/issues/31/1806846428@ github.com>

[TheAppleFreak]

Alright, updated everything, ran the tests, and the issue should be fixed! Thanks for letting me know about this!