Code Monkey home page Code Monkey logo

node-express-mongo-db-mongoose-denormalization's Introduction

Node, Express, MongoDB and Mongoose Embedded Documents Relationships (Denormalization)

js-standard-style License: MIT

Overview

This is an easy, basic and raw example of HOW to implement Embedded Documents Relationships (Denormalization) with Mongoose.

For a dryer approach, check Generic Controllers.

Requirements

  • Node 12+
  • NPM
  • MongoDB
  • Mongoose ODM
  • Optional: MongoDB account

Install dependencies

npm install

Running the server

Development

npm run dev

Production

npm run build

npm start

API endpoints

GET /api/artists

  • Returns an object with the key data containing an array of objects with 40 records (max).
  • Supports query string:
    • ?limit=integer
    • ?offset=integer

Request:

curl http://127.0.0.1:3000/api/artists

Sample response:

{
  "data": [
    {
      "_id": "6206ad6f6dcc7026ff2a19cd",
      "name": "Guns N' Roses",
      "__v": 0
    }
  ]
}

POST /api/artists

  • Returns the newly created object (aka, artist).
  • The server only accepts a payload with the property name.

Request:

curl -X POST http://127.0.0.1:3000/api/artists -d '{"name":"Green Day"}' -H "Content-Type: application/json"

Sample response:

{
  "_id": "6206e65c3d571063b00e9b22",
  "name": "Green Day",
  "__v": 0
}

GET /api/songs

  • Returns an object with the key data containing an array of objects with 40 records (max).
  • Supports query string:
    • ?limit=integer
    • ?offset=integer

Request:

curl http://127.0.0.1:3000/api/songs

Sample response:

{
  "data": [
    {
      "_id": "6206e7f58a567a65fc1553d1",
      "name": "Basket Case",
      "artist": {
        "_id": "6206e65c3d571063b00e9b22",
        "name": "Green Day"
      },
      "__v": 0
    }
  ]
}

POST /api/songs

  • Returns the newly created object (aka, song).
  • The server only accepts a payload with the properties name and artist.

IMPORTANT: You have to pass a valid MongoDB ObjectId which should be the _id of an existent artist.

Request:

curl -X POST http://127.0.0.1:3000/api/songs -d '{"name":"Basket Case", "artist": "6206e65c3d571063b00e9b22"}' -H "Content-Type: application/json"

Sample response:

{
  "_id": "6206e8ec8a567a65fc1553dd",
  "name": "Holiday",
  "artist": {
    "_id": "6206e65c3d571063b00e9b22",
    "name": "Green Day"
  },
  "__v": 0
}

GET everything else

  • Any other endpoint will retrieve an object

Request:

curl http://127.0.0.1:3000/

Response:

{
  "message": "Node.js, Express, MongoDB and Mongoose Denormalization!"
}

node-express-mongo-db-mongoose-denormalization's People

Contributors

alpersonalwebsite avatar

Watchers

 avatar

node-express-mongo-db-mongoose-denormalization's Issues

CVE-2022-2564 (High) detected in mongoose-5.13.14.tgz

CVE-2022-2564 - High Severity Vulnerability

Vulnerable Library - mongoose-5.13.14.tgz

Mongoose MongoDB ODM

Library home page: https://registry.npmjs.org/mongoose/-/mongoose-5.13.14.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/mongoose/package.json

Dependency Hierarchy:

  • mongoose-5.13.14.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.

Publish Date: 2022-07-28

URL: CVE-2022-2564

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2564

Release Date: 2022-07-28

Fix Resolution: 5.13.15


Step up your Open Source Security Game with Mend here

CVE-2022-25881 (High) detected in http-cache-semantics-4.1.0.tgz

CVE-2022-25881 - High Severity Vulnerability

Vulnerable Library - http-cache-semantics-4.1.0.tgz

Parses Cache-Control and other headers. Helps building correct HTTP caches and proxies

Library home page: https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/http-cache-semantics/package.json

Dependency Hierarchy:

  • nodemon-2.0.15.tgz (Root Library)
    • update-notifier-5.1.0.tgz
      • latest-version-5.1.0.tgz
        • package-json-6.5.0.tgz
          • got-9.6.0.tgz
            • cacheable-request-6.1.0.tgz
              • http-cache-semantics-4.1.0.tgz (Vulnerable Library)

Found in HEAD commit: 9e2b0b1efedc996235a789e9114fadab4c835f38

Found in base branch: master

Vulnerability Details

This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.

Publish Date: 2023-01-31

URL: CVE-2022-25881

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-25881

Release Date: 2023-01-31

Fix Resolution: http-cache-semantics - 4.1.1


Step up your Open Source Security Game with Mend here

CVE-2022-46175 (High) detected in multiple libraries

CVE-2022-46175 - High Severity Vulnerability

Vulnerable Libraries - json5-2.2.0.tgz, json5-0.5.1.tgz, json5-1.0.1.tgz

json5-2.2.0.tgz

JSON for humans.

Library home page: https://registry.npmjs.org/json5/-/json5-2.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/json5/package.json

Dependency Hierarchy:

  • core-7.17.5.tgz (Root Library)
    • json5-2.2.0.tgz (Vulnerable Library)
json5-0.5.1.tgz

JSON for the ES5 era.

Library home page: https://registry.npmjs.org/json5/-/json5-0.5.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/babel-core/node_modules/json5/package.json

Dependency Hierarchy:

  • babel-core-6.26.3.tgz (Root Library)
    • json5-0.5.1.tgz (Vulnerable Library)
json5-1.0.1.tgz

JSON for humans.

Library home page: https://registry.npmjs.org/json5/-/json5-1.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/tsconfig-paths/node_modules/json5/package.json

Dependency Hierarchy:

  • eslint-plugin-import-2.25.4.tgz (Root Library)
    • tsconfig-paths-3.12.0.tgz
      • json5-1.0.1.tgz (Vulnerable Library)

Found in HEAD commit: 9e2b0b1efedc996235a789e9114fadab4c835f38

Found in base branch: master

Vulnerability Details

JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The parse method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named __proto__, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by JSON5.parse and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from JSON5.parse. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. JSON5.parse should restrict parsing of __proto__ keys when parsing JSON strings to objects. As a point of reference, the JSON.parse method included in JavaScript ignores __proto__ keys. Simply changing JSON5.parse to JSON.parse in the examples above mitigates this vulnerability. This vulnerability is patched in json5 versions 1.0.2, 2.2.2, and later.

Publish Date: 2022-12-24

URL: CVE-2022-46175

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-46175

Release Date: 2022-12-24

Fix Resolution (json5): 2.2.2

Direct dependency fix Resolution (@babel/core): 7.17.9

Fix Resolution (json5): 1.0.2

Direct dependency fix Resolution (babel-core): 7.0.0-bridge.0

Fix Resolution (json5): 1.0.2

Direct dependency fix Resolution (eslint-plugin-import): 2.26.0


Step up your Open Source Security Game with Mend here

CVE-2021-23440 (High) detected in set-value-2.0.1.tgz - autoclosed

CVE-2021-23440 - High Severity Vulnerability

Vulnerable Library - set-value-2.0.1.tgz

Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.

Library home page: https://registry.npmjs.org/set-value/-/set-value-2.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/set-value/package.json

Dependency Hierarchy:

  • babel-jest-26.6.3.tgz (Root Library)
    • transform-26.6.2.tgz
      • jest-haste-map-26.6.2.tgz
        • sane-4.1.0.tgz
          • micromatch-3.1.10.tgz
            • snapdragon-0.8.2.tgz
              • base-0.11.2.tgz
                • cache-base-1.0.1.tgz
                  • set-value-2.0.1.tgz (Vulnerable Library)

Found in HEAD commit: 9e2b0b1efedc996235a789e9114fadab4c835f38

Found in base branch: master

Vulnerability Details

This affects the package set-value before <2.0.1, >=3.0.0 <4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.
Mend Note: After conducting further research, Mend has determined that all versions of set-value up to version 4.0.0 are vulnerable to CVE-2021-23440.

Publish Date: 2021-09-12

URL: CVE-2021-23440

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-09-12

Fix Resolution (set-value): 4.0.1

Direct dependency fix Resolution (babel-jest): 27.0.0


Step up your Open Source Security Game with Mend here

CVE-2021-35065 (High) detected in glob-parent-5.1.2.tgz - autoclosed

CVE-2021-35065 - High Severity Vulnerability

Vulnerable Library - glob-parent-5.1.2.tgz

Extract the non-magic parent path from a glob string.

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/glob-parent/package.json

Dependency Hierarchy:

  • eslint-7.32.0.tgz (Root Library)
    • glob-parent-5.1.2.tgz (Vulnerable Library)

Found in HEAD commit: 9e2b0b1efedc996235a789e9114fadab4c835f38

Found in base branch: master

Vulnerability Details

The package glob-parent from 6.0.0 and before 6.0.1 are vulnerable to Regular Expression Denial of Service (ReDoS)

Publish Date: 2021-06-22

URL: CVE-2021-35065

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cj88-88mr-972w

Release Date: 2021-06-22

Fix Resolution: glob-parent - 6.0.1


Step up your Open Source Security Game with Mend here

CVE-2022-24304 (High) detected in mongoose-5.13.14.tgz - autoclosed

CVE-2022-24304 - High Severity Vulnerability

Vulnerable Library - mongoose-5.13.14.tgz

Mongoose MongoDB ODM

Library home page: https://registry.npmjs.org/mongoose/-/mongoose-5.13.14.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/mongoose/package.json

Dependency Hierarchy:

  • mongoose-5.13.14.tgz (Vulnerable Library)

Found in HEAD commit: 9e2b0b1efedc996235a789e9114fadab4c835f38

Found in base branch: master

Vulnerability Details

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-2564. Reason: This candidate is a duplicate of CVE-2022-2564. Notes: All CVE users should reference CVE-2022-2564 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

Publish Date: 2022-08-26

URL: CVE-2022-24304

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-08-26

Fix Resolution: 6.4.6


Step up your Open Source Security Game with Mend here

CVE-2022-37603 (High) detected in loader-utils-2.0.2.tgz

CVE-2022-37603 - High Severity Vulnerability

Vulnerable Library - loader-utils-2.0.2.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-2.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/loader-utils/package.json

Dependency Hierarchy:

  • eslint-loader-4.0.2.tgz (Root Library)
    • loader-utils-2.0.2.tgz (Vulnerable Library)

Found in HEAD commit: 9e2b0b1efedc996235a789e9114fadab4c835f38

Found in base branch: master

Vulnerability Details

A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.

Publish Date: 2022-10-14

URL: CVE-2022-37603

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-3rfm-jhwj-7488

Release Date: 2022-10-14

Fix Resolution: loader-utils - 1.4.2,2.0.4,3.2.1


Step up your Open Source Security Game with Mend here

CVE-2023-25166 (Medium) detected in formula-3.0.0.tgz

CVE-2023-25166 - Medium Severity Vulnerability

Vulnerable Library - formula-3.0.0.tgz

Math and string formula parser.

Library home page: https://registry.npmjs.org/@sideway/formula/-/formula-3.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/@sideway/formula/package.json

Dependency Hierarchy:

  • joi-17.6.0.tgz (Root Library)
    • formula-3.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 9e2b0b1efedc996235a789e9114fadab4c835f38

Found in base branch: master

Vulnerability Details

formula is a math and string formula parser. In versions prior to 3.0.1 crafted user-provided strings to formula's parser might lead to polynomial execution time and a denial of service. Users should upgrade to 3.0.1+. There are no known workarounds for this vulnerability.

Publish Date: 2023-02-08

URL: CVE-2023-25166

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-25166

Release Date: 2023-02-08

Fix Resolution: @sideway/formula - 3.0.1


Step up your Open Source Security Game with Mend here

CVE-2022-37599 (High) detected in loader-utils-2.0.2.tgz

CVE-2022-37599 - High Severity Vulnerability

Vulnerable Library - loader-utils-2.0.2.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-2.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/loader-utils/package.json

Dependency Hierarchy:

  • eslint-loader-4.0.2.tgz (Root Library)
    • loader-utils-2.0.2.tgz (Vulnerable Library)

Found in HEAD commit: 9e2b0b1efedc996235a789e9114fadab4c835f38

Found in base branch: master

Vulnerability Details

A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the resourcePath variable in interpolateName.js.

Publish Date: 2022-10-11

URL: CVE-2022-37599

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hhq3-ff78-jv3g

Release Date: 2022-10-11

Fix Resolution: loader-utils - 1.4.2,2.0.4,3.2.1


Step up your Open Source Security Game with Mend here

CVE-2022-38900 (High) detected in decode-uri-component-0.2.0.tgz

CVE-2022-38900 - High Severity Vulnerability

Vulnerable Library - decode-uri-component-0.2.0.tgz

A better decodeURIComponent

Library home page: https://registry.npmjs.org/decode-uri-component/-/decode-uri-component-0.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/decode-uri-component/package.json

Dependency Hierarchy:

  • babel-jest-26.6.3.tgz (Root Library)
    • transform-26.6.2.tgz
      • jest-haste-map-26.6.2.tgz
        • sane-4.1.0.tgz
          • micromatch-3.1.10.tgz
            • snapdragon-0.8.2.tgz
              • source-map-resolve-0.5.3.tgz
                • decode-uri-component-0.2.0.tgz (Vulnerable Library)

Found in HEAD commit: 9e2b0b1efedc996235a789e9114fadab4c835f38

Found in base branch: master

Vulnerability Details

decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.

Publish Date: 2022-11-28

URL: CVE-2022-38900

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-w573-4hg7-7wgq

Release Date: 2022-11-28

Fix Resolution (decode-uri-component): 0.2.1

Direct dependency fix Resolution (babel-jest): 27.0.0


Step up your Open Source Security Game with Mend here

CVE-2022-37601 (High) detected in loader-utils-2.0.2.tgz

CVE-2022-37601 - High Severity Vulnerability

Vulnerable Library - loader-utils-2.0.2.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-2.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/loader-utils/package.json

Dependency Hierarchy:

  • eslint-loader-4.0.2.tgz (Root Library)
    • loader-utils-2.0.2.tgz (Vulnerable Library)

Found in HEAD commit: 9e2b0b1efedc996235a789e9114fadab4c835f38

Found in base branch: master

Vulnerability Details

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils 2.0.0 via the name variable in parseQuery.js.

Publish Date: 2022-10-12

URL: CVE-2022-37601

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-76p3-8jx3-jpfq

Release Date: 2022-10-12

Fix Resolution: loader-utils - 1.4.1,2.0.3


Step up your Open Source Security Game with Mend here

CVE-2021-3807 (High) detected in ansi-regex-3.0.0.tgz

CVE-2021-3807 - High Severity Vulnerability

Vulnerable Library - ansi-regex-3.0.0.tgz

Regular expression for matching ANSI escape codes

Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-3.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/eslint-friendly-formatter/node_modules/ansi-regex/package.json

Dependency Hierarchy:

  • eslint-friendly-formatter-4.0.1.tgz (Root Library)
    • strip-ansi-4.0.0.tgz
      • ansi-regex-3.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 9e2b0b1efedc996235a789e9114fadab4c835f38

Found in base branch: master

Vulnerability Details

ansi-regex is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-09-17

URL: CVE-2021-3807

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994/

Release Date: 2021-09-17

Fix Resolution: ansi-regex - 5.0.1,6.0.1


Step up your Open Source Security Game with Mend here

CVE-2022-33987 (Medium) detected in got-9.6.0.tgz

CVE-2022-33987 - Medium Severity Vulnerability

Vulnerable Library - got-9.6.0.tgz

Simplified HTTP requests

Library home page: https://registry.npmjs.org/got/-/got-9.6.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/got/package.json

Dependency Hierarchy:

  • nodemon-2.0.15.tgz (Root Library)
    • update-notifier-5.1.0.tgz
      • latest-version-5.1.0.tgz
        • package-json-6.5.0.tgz
          • got-9.6.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.

Publish Date: 2022-06-18

URL: CVE-2022-33987

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-33987

Release Date: 2022-06-18

Fix Resolution (got): 11.8.6

Direct dependency fix Resolution (nodemon): 2.0.20


Step up your Open Source Security Game with Mend here

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.