CVE-2022-0624: Authorization Bypass in parse-path
Summary
CVE-2022-0624: Authorization Bypass in parse-path. Affects parse-path versions < 5.0.0. Fixed in 5.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'parse-path' package is an npm package used for parsing and manipulating file paths. It provides functions to extract information such as the directory, filename, and extension from a given path. The package is widely used in JavaScript projects for file path manipulation.
Vulnerability Detail
The 'parse-path' package prior to version 5.0.0 is affected by an authorization bypass vulnerability. This vulnerability allows an attacker to bypass authorization checks by providing a user-controlled key. By exploiting this vulnerability, an attacker can gain unauthorized access to restricted resources or perform actions that should be restricted to privileged users. The vulnerability has a CVSS score of 7.3, indicating a high severity.
How To Fix
Minimum fixed version
5.0.0
This is the first release that contains the fix.
npm install parse-path@5.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The 'parse-path' package prior to version 5.0.0 is affected by an authorization bypass vulnerability. It is recommended to upgrade to version 5.0.0 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for parse-path →
FAQ
This vulnerability allows an attacker to bypass authorization checks and gain unauthorized access to restricted resources or perform privileged actions.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file to the playground and it will alert you if the vulnerability is present.
No, there are no known workarounds for this vulnerability. It is recommended to upgrade to the fixed version of the 'parse-path' package.
No, there is no known exploit code available for this vulnerability at the moment.
You can find more information about this vulnerability in the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-3j8f-xvm3-ffx4/GHSA-3j8f-xvm3-ffx4.json
