CVE-2016-10538CWE-22

The package `node-cli` before 1.0.0 insecurely uses the lock_file and log_file

published May 31, 2018

CVSS
—
EPSS
1%
Percentile
61.8
In the wild
Unconfirmed
What it is

The package `node-cli` before 1.0.0 insecurely uses the lock_file and log_file. Both of these are temporary, but it allows the starting user to overwrite any file they have access to.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00977 · 61.8th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2018-05-31T20:00Z
EPSS history
Timeline
  • 31 MAY 20:00Z
    The package `node-cli` before 1.0.0 insecurely uses the lock_file and log_file
    cvelistv5