Remote Code Execution (RCE) Affecting org.webjars.npm:bunyan package, versions [0,]
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGWEBJARSNPM-574716
- published 24 Jun 2020
- disclosed 24 Jun 2020
- credit Unknown
How to fix?
There is no fixed version for org.webjars.npm:bunyan.
Overview
org.webjars.npm:bunyan is an a JSON logging library for node.js services
Affected versions of this package are vulnerable to Remote Code Execution (RCE) via insecure command formatting which allowed creating a "hacked" file in the current dir.
References
CVSS Scores
version 3.1