CVE-2018-7408: High severity npmjs npm vulnerability

Published Feb 22, 2018

Updated

An issue was discovered in an npm 5.7.0 2018-02-21 pre-release (marked as "next: 5.7.0" and therefore automatically installed by an "npm upgrade -g npm" command, and also announced in the vendor's blog without mention of pre-release status). It might allow local users to bypass intended filesystem access restrictions because ownerships of /etc and /usr directories are being changed unexpectedly, related to a "correctMkdir" issue.

Affected Software

1 affected component

npmjs npm=5.7.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade npm to a version that resolves this vulnerability.
Fixed in 5.7.0
Compensating control
Mitigate the risk by preventing untrusted local users from modifying or influencing filesystem paths under /etc and /usr while remediation is applied.

Event History

Feb 22, 2018

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Data Sourced

via NVD·06:29 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2018-7408?

CVE-2018-7408 refers to an issue that was discovered in an npm 5.7.0 pre-release, allowing local users to bypass intended filesystem access restrictions.

How severe is CVE-2018-7408?

CVE-2018-7408 has a severity score of 7.8, which is considered high.

What software versions are affected by CVE-2018-7408?

Only version 5.7.0 of npm is affected by CVE-2018-7408.

How can I fix CVE-2018-7408?

To fix CVE-2018-7408, update npm to a version that is not affected by the vulnerability.

Where can I find more information about CVE-2018-7408?

You can find more information about CVE-2018-7408 in the vendor's blog post and GitHub commit and issues.