CVE-2018-7408

An issue was discovered in an npm 5.7.0 2018-02-21 pre-release (marked as "next: 5.7.0" and therefore automatically installed by an "npm upgrade -g npm"…

published February 22, 2018

CVSS
—
EPSS
0%
Percentile
23.6
In the wild
Unconfirmed
What it is

An issue was discovered in an npm 5.7.0 2018-02-21 pre-release (marked as "next: 5.7.0" and therefore automatically installed by an "npm upgrade -g npm" command, and also announced in the vendor's blog without mention of pre-release status). It might allow local users to bypass intended filesystem access restrictions because ownerships of /etc and /usr directories are being changed unexpectedly, related to a "correctMkdir" issue.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00320 · 23.6th percentile
Published
2018-02-22T18:00Z
EPSS history
Timeline
  • 22 FEB 18:00Z
    An issue was discovered in an npm 5.7.0 2018-02-21 pre-release (marked as "next: 5.7.0" and therefore automatically installed by an "npm upgrade -g npm"…
    cvelistv5