low3.3
CVE-2013-4116
Local Privilege Escalation in npm
Impact
Affected versions of `npm` use predictable temporary file names during archive unpacking. If an attacker can create a symbolic link at the location of one of these temporary file names, the attacker can arbitrarily write to any file that the user which owns the `npm` process has permission to write to, potentially resulting in local privilege escalation. ## Recommendation Update to version 1.3.3 or later.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | npm | < 1.3.3 | 1.3.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Node Packaged Modules Project | Node Packaged Modules | before 1.3.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.openwall.com/lists/oss-security/2013/07/10/17
- http://www.openwall.com/lists/oss-security/2013/07/11/9
- http://www.securityfocus.com/bid/61083
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=715325
- https://bugzilla.redhat.com/show_bug.cgi?id=983917
- https://exchange.xforce.ibmcloud.com/vulnerabilities/87141
- https://github.com/npm/npm/commit/f4d31693
- https://github.com/npm/npm/issues/3635
- https://github.com/advisories/GHSA-v3jv-wrf4-5845
- https://www.npmjs.com/advisories/152
- https://nvd.nist.gov/vuln/detail/CVE-2013-4116