You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Path to dependency file: /core/jazz_cognito-authorizer/package.json
Path to vulnerable library: /core/jazz_cognito-authorizer/node_modules/hoek/package.json,/core/jazz_token-authorizer/node_modules/hoek/package.json,/core/jazz_cognito-admin-authorizer/node_modules/hoek/package.json
Dependency Hierarchy:
jsonwebtoken-7.4.3.tgz (Root Library)
joi-6.10.1.tgz
❌ hoek-2.16.3.tgz (Vulnerable Library)
Found in base branch: develop
Vulnerability Details
hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.
CVE-2018-3728 - High Severity Vulnerability
General purpose node utilities
Library home page: https://registry.npmjs.org/hoek/-/hoek-2.16.3.tgz
Path to dependency file: /core/jazz_cognito-authorizer/package.json
Path to vulnerable library: /core/jazz_cognito-authorizer/node_modules/hoek/package.json,/core/jazz_token-authorizer/node_modules/hoek/package.json,/core/jazz_cognito-admin-authorizer/node_modules/hoek/package.json
Dependency Hierarchy:
Found in base branch: develop
hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.
Publish Date: 2018-03-30
URL: CVE-2018-3728
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16082
Release Date: 2018-03-30
Fix Resolution (hoek): 4.2.0
Direct dependency fix Resolution (jsonwebtoken): 8.0.0
⛑️ Automatic Remediation will be attempted for this issue.
The text was updated successfully, but these errors were encountered: