GHSA-84QJ-9QF2-Q92R

Vulnerability from github – Published: 2020-09-03 00:32 – Updated: 2023-07-13 21:06
VLAI?
Summary
Malicious Package in pm-controls
Details

Version 1.1.8 of pm-controls contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl=

Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised. Users may downgrade to 1.1.7

Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "pm-controls"
      },
      "versions": [
        "1.1.8"
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:41:38Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "Version 1.1.8 of `pm-controls` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`\n\n\n\n## Recommendation\n\nRemove the package from your environment and evaluate your application to determine whether or not user data was compromised. Users may downgrade to 1.1.7",
  "id": "GHSA-84qj-9qf2-q92r",
  "modified": "2023-07-13T21:06:36Z",
  "published": "2020-09-03T00:32:30Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/advisories/949"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Malicious Package in pm-controls"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.