Cx77c0fe72-ea38 @ Npm-yauzl-2.4.1

[CMaheshBL]

Vulnerable Package issue exists @ Npm-yauzl-2.4.1 in branch master

The package yauzl before 2.9.2 uses a deprecated version of Buffer API. The constructor new Buffer()
can cause the Buffer to be created by allocating new, uninitialized memory. This uninitialized memory can contain potentially sensitive data that can end up being leaked if not handled appropriately. Due to this flaw, confidentiality is affected.

Namespace: CMaheshBL
Repository: NodeGoat
Repository Url: https://github.com/CMaheshBL/NodeGoat
CxAST-Project: CMaheshBL/NodeGoat
CxAST platform scan: d7c1c0af-6b2d-455e-8753-a6b87dbf733d
Branch: master
Application: NodeGoat
Severity: MEDIUM
State: NOT_IGNORED
Status: RECURRENT
CWE: CWE-908

---

Addition Info
Attack vector: NETWORK
Attack complexity: HIGH
Confidentiality impact: HIGH
Availability impact: NONE
Remediation Upgrade Recommendation: 2.9.2

---

References
Issue
Pull request
Commit
Commit