morgan-1.10.1.tgz: 2 vulnerabilities (highest severity is: 9.8) [master]

[mend-developer-platform-dev]

📂 Vulnerable Library - morgan-1.10.1.tgz

HTTP request logger middleware for node.js

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/morgan/package.json

Findings

Finding	Severity	🎯 CVSS	Exploit Maturity	EPSS	Library	Type	Fixed in	Remediation Available	Reachability
CVE-154062-641864	🟣 Critical	9.8	N/A	N/A	ee-first-1.1.1.tgz	Transitive	N/A	❌
CVE-587792-470342	🟣 Critical	9.8	N/A	N/A	on-finished-2.3.0.tgz	Transitive	N/A	❌

Details

🟣CVE-154062-641864

Vulnerable Library - ee-first-1.1.1.tgz

return the first event in a set of ee/event pairs

Library home page: https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ee-first/package.json

Dependency Hierarchy:

• morgan-1.10.1.tgz (Root Library)

  • on-finished-2.3.0.tgz
    • ❌ ee-first-1.1.1.tgz (Vulnerable Library)

• express-4.21.2.tgz (Root Library)

  • on-finished-2.4.1.tgz
    • ❌ ee-first-1.1.1.tgz (Vulnerable Library)

---

Vulnerability Details

Created automatically by the test suite

Publish Date: Jun 07, 2010 05:12 PM

URL: CVE-154062-641864

Threat Assessment

Exploit Maturity:N/A

EPSS:N/A

Score: 9.8

---

Suggested Fix

Type: Upgrade version

Origin:

Release Date:

Fix Resolution :

🟣CVE-587792-470342

Vulnerable Library - on-finished-2.3.0.tgz

Execute a callback when a request closes, finishes, or errors

Library home page: https://registry.npmjs.org/on-finished/-/on-finished-2.3.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/morgan/node_modules/on-finished/package.json

Dependency Hierarchy:

• morgan-1.10.1.tgz (Root Library)
  • ❌ on-finished-2.3.0.tgz (Vulnerable Library)

---

Vulnerability Details

Created automatically by the test suite

Publish Date: Jun 07, 2010 05:12 PM

URL: CVE-587792-470342

Threat Assessment

Exploit Maturity:N/A

EPSS:N/A

Score: 9.8

---

Suggested Fix

Type: Upgrade version

Origin:

Release Date:

Fix Resolution :