CVE-2017-16225
UNKNOWN
Published 2018-06-07T02:00:00Z
Actions:
Expert Analysis
Professional remediation guidance
Get tailored security recommendations from our analyst team for CVE-2017-16225. We'll provide specific mitigation strategies based on your environment and risk profile.
No CVSS data available
Description
aegir is a module to help automate JavaScript project management. Version 12.0.0 through and including 12.0.7 bundled and published to npm the user (that performed a aegir-release) GitHub token.
Available Exploits
No exploits available for this CVE.
Related News
No news articles found for this CVE.
Affected Products
Affected Versions:
GitHub Security Advisories
Community-driven vulnerability intelligence from GitHub
Advisory Details
Affected versions of `aegir` bundle and publish the current users github token to npm when `aegir-release` is executed.
## Recommendation
Update to version 12.0.8 or later.
If you used this module to do a release for your project you should invalidate the GitHub tokens that were leaked.
Affected Packages
npm
aegir
ECOSYSTEM:
≥12.0.0
<12.0.8
CVSS Scoring
CVSS Score
7.5
References
Advisory provided by GitHub Security Advisory Database. Published: July 24, 2018, Modified: August 31, 2020
References
Published: 2018-06-07T02:00:00Z
Last Modified: 2024-09-16T16:52:51.508Z
Copied to clipboard!