CVE Feed

    Dashboard / CVE / CVE-2018-7408

    CVE-2018-7408

    An issue was discovered in an npm 5.7.0 2018-02-21 pre-release (marked as "next: 5.7.0" and therefore automatically installed by an "npm upgrade -g npm" command, and also announced in the vendor's blog without mention of pre-release status). It might allow local users to bypass intended filesystem access restrictions because ownerships of /etc and /usr directories are being changed unexpectedly, related to a "correctMkdir" issue.

    Published:Feb 22, 2018
    Last Modified:Nov 21, 2024
    EPS:Feb 22, 2018
    EPSS Score:0.00042
    CVSS Score:7.8

    Affected Products

    Vendor
    Npmjs
    Product
    Npm

    Exploits

    No exploit reference

    Related CVEs

    CVE-2022-29244 (CVSS 7.5) — npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or wit…
    CVE-2021-39135 (CVSS 8.2) — `@npmcli/arborist`, the library that calculates dependency trees and manages the node_modules folder hierarchy…
    CVE-2021-39134 (CVSS 8.2) — `@npmcli/arborist`, the library that calculates dependency trees and manages the `node_modules` folder hierarc…
    CVE-2021-43616 (CVSS 9) — The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency informati…
    CVE-2020-15095 (CVSS 4.4) — Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log fi…
    CVE-2019-16776 (CVSS 7.7) — Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access …
    CVE-2019-16777 (CVSS 7.7) — Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent exi…
    CVE-2019-16775 (CVSS 7.7) — Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages…
    CVE-2016-3956 (CVSS 7.5) — The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High