📂 Vulnerable Library - helmet-2.3.0.tgz
help secure Express/Connect apps with various HTTP headers
Path to dependency file: /NodeGoat/package.json
Findings
| Finding |
Severity |
🎯 CVSS |
Exploit Maturity |
EPSS |
Library |
Type |
Fixed in |
Remediation Available |
Reachability |
| CVE-238984-357813 |
🟣 Critical |
9.8 |
N/A |
N/A |
debug-2.2.0.tgz |
Transitive |
N/A |
❌ |
|
| CVE-587792-470342 |
🟣 Critical |
9.8 |
N/A |
N/A |
on-finished-2.3.0.tgz |
Transitive |
N/A |
❌ |
|
| CVE-768328-330953 |
🟣 Critical |
9.8 |
N/A |
N/A |
ms-0.7.1.tgz |
Transitive |
N/A |
❌ |
|
| CVE-984631-293917 |
🟣 Critical |
9.8 |
N/A |
N/A |
utils-merge-1.0.0.tgz |
Transitive |
N/A |
❌ |
|
| WS-2019-0289 |
🟠 Medium |
6.1 |
N/A |
N/A |
helmet-csp-1.2.2.tgz |
Transitive |
N/A |
❌ |
 Unreachable |
| CVE-2017-20162 |
🟠 Medium |
5.3 |
Not Defined |
< 1% |
ms-0.7.1.tgz |
Transitive |
N/A |
❌ |
Unreachable |
| CVE-2017-20165 |
🟠 Medium |
5.1 |
Not Defined |
1.2% |
debug-2.2.0.tgz |
Transitive |
N/A |
❌ |
Unreachable |
Details
🟣CVE-238984-357813
Vulnerable Library - debug-2.2.0.tgz
small debugging utility
Library home page: https://registry.npmjs.org/debug/-/debug-2.2.0.tgz
Path to dependency file: /NodeGoat/package.json
Dependency Hierarchy:
- helmet-2.3.0.tgz (Root Library)
- connect-3.4.1.tgz
- finalhandler-0.4.1.tgz
- ❌ debug-2.2.0.tgz (Vulnerable Library)
Vulnerability Details
Created automatically by the test suite
Publish Date: Jun 07, 2010 05:12 PM
URL: CVE-238984-357813
Threat Assessment
Exploit Maturity:N/A
EPSS:N/A
Score: 9.8
Suggested Fix
Type: Upgrade version
Origin:
Release Date:
Fix Resolution :
🟣CVE-587792-470342
Vulnerable Library - on-finished-2.3.0.tgz
Execute a callback when a request closes, finishes, or errors
Library home page: https://registry.npmjs.org/on-finished/-/on-finished-2.3.0.tgz
Path to dependency file: /NodeGoat/package.json
Dependency Hierarchy:
-
express-4.16.4.tgz (Root Library)
- ❌ on-finished-2.3.0.tgz (Vulnerable Library)
-
helmet-2.3.0.tgz (Root Library)
- connect-3.4.1.tgz
- finalhandler-0.4.1.tgz
- ❌ on-finished-2.3.0.tgz (Vulnerable Library)
-
body-parser-1.18.3.tgz (Root Library)
- ❌ on-finished-2.3.0.tgz (Vulnerable Library)
Vulnerability Details
Created automatically by the test suite
Publish Date: Jun 07, 2010 05:12 PM
URL: CVE-587792-470342
Threat Assessment
Exploit Maturity:N/A
EPSS:N/A
Score: 9.8
Suggested Fix
Type: Upgrade version
Origin:
Release Date:
Fix Resolution :
🟣CVE-768328-330953
Vulnerable Library - ms-0.7.1.tgz
Tiny ms conversion utility
Library home page: https://registry.npmjs.org/ms/-/ms-0.7.1.tgz
Path to dependency file: /NodeGoat/package.json
Dependency Hierarchy:
- helmet-2.3.0.tgz (Root Library)
- connect-3.4.1.tgz
- debug-2.2.0.tgz
- ❌ ms-0.7.1.tgz (Vulnerable Library)
Vulnerability Details
Created automatically by the test suite
Publish Date: Jun 07, 2010 05:12 PM
URL: CVE-768328-330953
Threat Assessment
Exploit Maturity:N/A
EPSS:N/A
Score: 9.8
Suggested Fix
Type: Upgrade version
Origin:
Release Date:
Fix Resolution :
🟣CVE-984631-293917
Vulnerable Library - utils-merge-1.0.0.tgz
merge() utility function
Library home page: https://registry.npmjs.org/utils-merge/-/utils-merge-1.0.0.tgz
Path to dependency file: /NodeGoat/package.json
Dependency Hierarchy:
- helmet-2.3.0.tgz (Root Library)
- connect-3.4.1.tgz
- ❌ utils-merge-1.0.0.tgz (Vulnerable Library)
Vulnerability Details
Created automatically by the test suite
Publish Date: Jun 07, 2010 05:12 PM
URL: CVE-984631-293917
Threat Assessment
Exploit Maturity:N/A
EPSS:N/A
Score: 9.8
Suggested Fix
Type: Upgrade version
Origin:
Release Date:
Fix Resolution :
🟠WS-2019-0289
Vulnerable Library - helmet-csp-1.2.2.tgz
Content Security Policy middleware.
Library home page: https://registry.npmjs.org/helmet-csp/-/helmet-csp-1.2.2.tgz
Path to dependency file: /NodeGoat/package.json
Dependency Hierarchy:
- helmet-2.3.0.tgz (Root Library)
- ❌ helmet-csp-1.2.2.tgz (Vulnerable Library)
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
Helmet-csp before 2.9.1 is vulnerable to a Configuration Override affecting the application's Content Security Policy (CSP). The package's browser sniffing for Firefox deletes the default-src CSP policy, which is the fallback policy. This allows an attacker to remove an application's default CSP, possibly rendering the application vulnerable to Cross-Site Scripting.
Publish Date: Nov 18, 2019 03:14 AM
URL: WS-2019-0289
Threat Assessment
Exploit Maturity:N/A
EPSS:N/A
Score: 6.1
Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1176
Release Date: Nov 18, 2019 03:14 AM
Fix Resolution : 2.9.1
🟠CVE-2017-20162
Vulnerable Library - ms-0.7.1.tgz
Tiny ms conversion utility
Library home page: https://registry.npmjs.org/ms/-/ms-0.7.1.tgz
Path to dependency file: /NodeGoat/package.json
Dependency Hierarchy:
- helmet-2.3.0.tgz (Root Library)
- connect-3.4.1.tgz
- debug-2.2.0.tgz
- ❌ ms-0.7.1.tgz (Vulnerable Library)
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
A vulnerability, which was classified as problematic, has been found in vercel ms up to 1.x. This issue affects the function parse of the file index.js. The manipulation of the argument str leads to inefficient regular expression complexity. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The patch is named caae2988ba2a37765d055c4eee63d383320ee662. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217451.
Publish Date: Jan 05, 2023 11:49 AM
URL: CVE-2017-20162
Threat Assessment
Exploit Maturity:Not Defined
EPSS:< 1%
Score: 5.3
Suggested Fix
Type: Upgrade version
Origin: GHSA-w9mr-4mfr-499f
Release Date: Jan 05, 2023 11:49 AM
Fix Resolution : ms - 2.0.0
🟠CVE-2017-20165
Vulnerable Library - debug-2.2.0.tgz
small debugging utility
Library home page: https://registry.npmjs.org/debug/-/debug-2.2.0.tgz
Path to dependency file: /NodeGoat/package.json
Dependency Hierarchy:
- helmet-2.3.0.tgz (Root Library)
- connect-3.4.1.tgz
- finalhandler-0.4.1.tgz
- ❌ debug-2.2.0.tgz (Vulnerable Library)
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The identifier of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability.
Publish Date: Jan 09, 2023 09:33 AM
URL: CVE-2017-20165
Threat Assessment
Exploit Maturity:Not Defined
EPSS:1.2%
Score: 5.1
Suggested Fix
Type: Upgrade version
Origin: GHSA-9vvw-cc9w-f27h
Release Date: Jan 09, 2023 09:33 AM
Fix Resolution : debug - 2.6.9,debug - 3.1.0
📂 Vulnerable Library - helmet-2.3.0.tgz
help secure Express/Connect apps with various HTTP headers
Path to dependency file: /NodeGoat/package.json
Findings
Details
🟣CVE-238984-357813
Vulnerable Library - debug-2.2.0.tgz
small debugging utility
Library home page: https://registry.npmjs.org/debug/-/debug-2.2.0.tgz
Path to dependency file: /NodeGoat/package.json
Dependency Hierarchy:
Vulnerability Details
Created automatically by the test suite
Publish Date: Jun 07, 2010 05:12 PM
URL: CVE-238984-357813
Threat Assessment
Exploit Maturity:N/A
EPSS:N/A
Score: 9.8
Suggested Fix
Type: Upgrade version
Origin:
Release Date:
Fix Resolution :
🟣CVE-587792-470342
Vulnerable Library - on-finished-2.3.0.tgz
Execute a callback when a request closes, finishes, or errors
Library home page: https://registry.npmjs.org/on-finished/-/on-finished-2.3.0.tgz
Path to dependency file: /NodeGoat/package.json
Dependency Hierarchy:
express-4.16.4.tgz (Root Library)
helmet-2.3.0.tgz (Root Library)
body-parser-1.18.3.tgz (Root Library)
Vulnerability Details
Created automatically by the test suite
Publish Date: Jun 07, 2010 05:12 PM
URL: CVE-587792-470342
Threat Assessment
Exploit Maturity:N/A
EPSS:N/A
Score: 9.8
Suggested Fix
Type: Upgrade version
Origin:
Release Date:
Fix Resolution :
🟣CVE-768328-330953
Vulnerable Library - ms-0.7.1.tgz
Tiny ms conversion utility
Library home page: https://registry.npmjs.org/ms/-/ms-0.7.1.tgz
Path to dependency file: /NodeGoat/package.json
Dependency Hierarchy:
Vulnerability Details
Created automatically by the test suite
Publish Date: Jun 07, 2010 05:12 PM
URL: CVE-768328-330953
Threat Assessment
Exploit Maturity:N/A
EPSS:N/A
Score: 9.8
Suggested Fix
Type: Upgrade version
Origin:
Release Date:
Fix Resolution :
🟣CVE-984631-293917
Vulnerable Library - utils-merge-1.0.0.tgz
merge() utility function
Library home page: https://registry.npmjs.org/utils-merge/-/utils-merge-1.0.0.tgz
Path to dependency file: /NodeGoat/package.json
Dependency Hierarchy:
Vulnerability Details
Created automatically by the test suite
Publish Date: Jun 07, 2010 05:12 PM
URL: CVE-984631-293917
Threat Assessment
Exploit Maturity:N/A
EPSS:N/A
Score: 9.8
Suggested Fix
Type: Upgrade version
Origin:
Release Date:
Fix Resolution :
🟠WS-2019-0289
Vulnerable Library - helmet-csp-1.2.2.tgz
Content Security Policy middleware.
Library home page: https://registry.npmjs.org/helmet-csp/-/helmet-csp-1.2.2.tgz
Path to dependency file: /NodeGoat/package.json
Dependency Hierarchy:
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
Helmet-csp before 2.9.1 is vulnerable to a Configuration Override affecting the application's Content Security Policy (CSP). The package's browser sniffing for Firefox deletes the default-src CSP policy, which is the fallback policy. This allows an attacker to remove an application's default CSP, possibly rendering the application vulnerable to Cross-Site Scripting.
Publish Date: Nov 18, 2019 03:14 AM
URL: WS-2019-0289
Threat Assessment
Exploit Maturity:N/A
EPSS:N/A
Score: 6.1
Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1176
Release Date: Nov 18, 2019 03:14 AM
Fix Resolution : 2.9.1
🟠CVE-2017-20162
Vulnerable Library - ms-0.7.1.tgz
Tiny ms conversion utility
Library home page: https://registry.npmjs.org/ms/-/ms-0.7.1.tgz
Path to dependency file: /NodeGoat/package.json
Dependency Hierarchy:
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
A vulnerability, which was classified as problematic, has been found in vercel ms up to 1.x. This issue affects the function parse of the file index.js. The manipulation of the argument str leads to inefficient regular expression complexity. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The patch is named caae2988ba2a37765d055c4eee63d383320ee662. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217451.
Publish Date: Jan 05, 2023 11:49 AM
URL: CVE-2017-20162
Threat Assessment
Exploit Maturity:Not Defined
EPSS:< 1%
Score: 5.3
Suggested Fix
Type: Upgrade version
Origin: GHSA-w9mr-4mfr-499f
Release Date: Jan 05, 2023 11:49 AM
Fix Resolution : ms - 2.0.0
🟠CVE-2017-20165
Vulnerable Library - debug-2.2.0.tgz
small debugging utility
Library home page: https://registry.npmjs.org/debug/-/debug-2.2.0.tgz
Path to dependency file: /NodeGoat/package.json
Dependency Hierarchy:
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The identifier of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability.
Publish Date: Jan 09, 2023 09:33 AM
URL: CVE-2017-20165
Threat Assessment
Exploit Maturity:Not Defined
EPSS:1.2%
Score: 5.1
Suggested Fix
Type: Upgrade version
Origin: GHSA-9vvw-cc9w-f27h
Release Date: Jan 09, 2023 09:33 AM
Fix Resolution : debug - 2.6.9,debug - 3.1.0