public-ip-4.0.4.tgz: 1 vulnerabilities (highest severity is: 5.3) #32
Description
Vulnerable Library - public-ip-4.0.4.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/got/package.json
Found in HEAD commit: a931f77b530aea29f7ca45b0dcd6db0d861a3320
Vulnerabilities
| Vulnerability | Severity |  CVSS |
Exploit Maturity | EPSS | Dependency | Type | Fixed in (public-ip version) | Remediation Possible** | Reachability |
|---|---|---|---|---|---|---|---|---|---|
| CVE-2022-33987 |  Medium |
5.3 | Not Defined | 0.8% | got-9.6.0.tgz | Transitive | N/A* | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2022-33987
Vulnerable Library - got-9.6.0.tgz
Simplified HTTP requests
Library home page: https://registry.npmjs.org/got/-/got-9.6.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/got/package.json
Dependency Hierarchy:
- public-ip-4.0.4.tgz (Root Library)
- ❌ got-9.6.0.tgz (Vulnerable Library)
Found in HEAD commit: a931f77b530aea29f7ca45b0dcd6db0d861a3320
Found in base branch: main
Vulnerability Details
The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
Publish Date: 2022-06-18
URL: CVE-2022-33987
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.8%
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: GHSA-pfrx-2q88-qq97
Release Date: 2022-06-18
Fix Resolution: got - 11.8.5,got - 12.1.0