CVE-2018-7408
Incorrect Permission Assignment for Critical Resource in NPM
Also known as GHSA-ph34-pc88-72gc
Published 8 y ago · modified 59 d ago · JSON
Summary
An issue was discovered in an npm 5.7.0 2018-02-21 pre-release (marked as "next: 5.7.0" and therefore automatically installed by an "npm upgrade -g npm" command, and also announced in the vendor's blog without mention of pre-release status). It might allow local users to bypass intended filesystem access restrictions because ownerships of /etc and /usr directories are being changed unexpectedly, related to a "correctMkdir" issue.
Exploit prediction (EPSS)
0.32% probability of exploitation in the next 30 days, higher than 25% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.8 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 4.6 | AV:L/AC:L/Au:N/C:P/I:P/A:P |
| GitHub | 3.0 | 7.8 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | npm | <5.7.1 | 5.7.1 |
Classification
- Weakness
- CWE-732 Incorrect Permission Assignment for Critical Resource
References
- github.com /npm/npm/commit/74e149da6efe6ed89477faa81fef08eee7999ad0 · x_refsource_MISC, x_transferred
- github.com /npm/npm/issues/19883 · x_refsource_MISC, x_transferred
- blog.npmjs.org /post/171169301000/v571 · x_refsource_MISC, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2018-7408 · advisory
Sources
- CVE List: CVE-2018-7408
- GitHub Advisory: GHSA-ph34-pc88-72gc
- NVD: CVE-2018-7408
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.