Lucene search

[email protected]NVD:CVE-2022-29244

HistoryJun 13, 2022 - 2:15 p.m.

CVE-2022-29244

2022-06-1314:15:09

CWE-200

[email protected]

web.nvd.nist.gov

npm

pack

publish

workspace

exclusion

directive

registry

upgrade

node.js

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.002

Percentile

58.3%

JSON

npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. --workspaces, --workspace=<name>). Anyone who has run npm pack or npm publish inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include. Users should upgrade to the latest, patched version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0 include the patched v8.11.0 version of npm.

Affected configurations

Nvd

Node

npmjsnpmRange7.9.0–8.11.0

Node

netappontap_select_deploy_administration_utilityMatch-

VendorProductVersionCPE
npmjsnpm*cpe:2.3:a:npmjs:npm:*:*:*:*:*:*:*:*
netappontap_select_deploy_administration_utility-cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
npmjs	npm	*	cpe:2.3:a:npmjs:npm::::::::
netapp	ontap_select_deploy_administration_utility	-	cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:::::::*