CVE-2022-29244

2022-06-2005:59:52

redhat.com

access.redhat.com

npm

flaw

exclusion

directives

sensitive information

unauthorized user

attacker

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.002

Percentile

58.3%

JSON

A flaw was found in npm. This security issue occurs because the npm pack ignores root-level “.gitignore” and “.npmignore” file exclusion directives when run in a workspace or with a workspace flag (for example, --workspaces, --workspace=). Anyone who has run ‘npm pack’ or ‘npm publish’ inside a workspace has published files into the npm registry they did not intend to include. This flaw exposes sensitive information to an unauthorized user or an attacker.