Lucene search

[email protected]CVE-2022-29244

HistoryJun 13, 2022 - 2:15 p.m.

CVE-2022-29244

2022-06-1314:15:09

CWE-200

[email protected]

web.nvd.nist.gov

112

cve-2022-29244

npm pack

npm publish

npm registry

security

upgrade

node.js

nvd

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

8.3 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

58.4%

JSON

npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. --workspaces, --workspace=<name>). Anyone who has run npm pack or npm publish inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include. Users should upgrade to the latest, patched version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0 include the patched v8.11.0 version of npm.

Affected configurations

Vulners

NVD

Node

npmnpmRange<7.9.0*

npmnpmRange<8.11.0

CPENameOperatorVersion
npmjs:npmnpmjs npmlt8.11.0

CPE	Name	Operator	Version
npmjs:npm	npmjs npm	lt	8.11.0

CNA Affected

[
  {
    "product": "npm",
    "vendor": "npm",
    "versions": [
      {
        "lessThan": "7.9.0*",
        "status": "affected",
        "version": "7.9.0",
        "versionType": "custom"
      },
      {
        "lessThan": "8.11.0",
        "status": "affected",
        "version": "8.11.0",
        "versionType": "custom"
      }
    ]
  }
]