CVE-2020-15095 MEDIUM

CVE-2020-15095: Sensitive information exposure through logs in npm cli

Vendor Npm
Product cli
Weakness CWE-532 · Sensitive info in logs
Published July 7, 2020
Last update August 4, 2024
View on NVD All CVEs

CVSS base score

4.4/10
Attack vector Local
Attack complexity High
Privileges required Low
User interaction Required
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>". The password value is not redacted and is printed to stdout and also to any generated log files.

Key dates

02Disclosure timeline

July 7, 2020 CVE published
August 4, 2024 Record updated