nock-11.7.0.tgz: 7 vulnerabilities (highest severity is: 9.8) [main] (unreachable)

<details>
  <summary>📂 Vulnerable Library - <strong>nock-11.7.0.tgz</strong></summary>

HTTP server mocking and expectations library for Node.js








</details>


# Findings
| Finding | Severity | 🎯 CVSS | Exploit Maturity | EPSS | Library | Type | Fixed in | Remediation Available | **Reachability** |
| ------------- | ------------- | ---- | --- | ----- | ----- | ----- | --- | --- | --- |
| [ CVE-796484-931798 ](https://www.mend.io/vulnerability-database/CVE-796484-931798) | 🟣 Critical | 9.8 | N/A | N/A | lodash-4.17.15.tgz | Transitive | N/A | ❌ | |
| [ CVE-2021-44906 ](https://www.mend.io/vulnerability-database/CVE-2021-44906) | 🟣 Critical | 9.3 | Not Defined | < 1% | minimist-0.0.8.tgz | Transitive | N/A | ❌ |<img src='https://whitesource-resources.whitesourcesoftware.com/viaGreen.png' width=20 height=22> Unreachable |
| [ CVE-2020-8203 ](https://www.mend.io/vulnerability-database/CVE-2020-8203) | 🔴 High | 8.3 | Not Defined | 2.4% | lodash-4.17.15.tgz | Transitive | N/A | ❌ |<img src='https://whitesource-resources.whitesourcesoftware.com/viaGreen.png' width=20 height=22> Unreachable |
| [ CVE-2021-23337 ](https://www.mend.io/vulnerability-database/CVE-2021-23337) | 🔴 High | 7.3 | Proof of concept | < 1% | lodash-4.17.15.tgz | Transitive | N/A | ❌ |<img src='https://whitesource-resources.whitesourcesoftware.com/viaGreen.png' width=20 height=22> Unreachable |
| [ CVE-2020-7751 ](https://www.mend.io/vulnerability-database/CVE-2020-7751) | 🔴 High | 7.0 | Not Defined | < 1% | pathval-1.1.0.tgz | Transitive | N/A | ❌ |<img src='https://whitesource-resources.whitesourcesoftware.com/viaGreen.png' width=20 height=22> Unreachable |
| [ CVE-2020-7598 ](https://www.mend.io/vulnerability-database/CVE-2020-7598) | 🟠 Medium | 6.3 | Not Defined | < 1% | minimist-0.0.8.tgz | Transitive | N/A | ❌ |<img src='https://whitesource-resources.whitesourcesoftware.com/viaGreen.png' width=20 height=22> Unreachable |
| [ CVE-2020-28500 ](https://www.mend.io/vulnerability-database/CVE-2020-28500) | 🟠 Medium | 5.5 | Proof of concept | < 1% | lodash-4.17.15.tgz | Transitive | N/A | ❌ |<img src='https://whitesource-resources.whitesourcesoftware.com/viaGreen.png' width=20 height=22> Unreachable |


# Details


<details>
  <summary>
 🟣CVE-796484-931798
  </summary>

### Vulnerable Library - **lodash-4.17.15.tgz**

Lodash modular utilities.

**Library home page:** [ https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz ](https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz)







**Dependency Hierarchy:**


- jest-24.9.0.tgz (Root Library)
    - jest-cli-24.9.0.tgz
        - jest-config-24.9.0.tgz
            - jest-environment-jsdom-24.9.0.tgz
                - jsdom-11.12.0.tgz
                    - request-promise-native-1.0.8.tgz
                        - request-promise-core-1.1.3.tgz
                            - ❌  **lodash-4.17.15.tgz** (Vulnerable Library)


- nock-11.7.0.tgz (Root Library)
    - ❌  **lodash-4.17.15.tgz** (Vulnerable Library)




***

### Vulnerability Details

Created automatically by the test suite

**Publish Date:** Jun 07, 2010 05:12 PM

**URL:** [ CVE-796484-931798 ](https://www.mend.io/vulnerability-database/CVE-796484-931798)

**Threat Assessment**

Exploit Maturity:N/A

EPSS:N/A

**Score:** 9.8


***
### Suggested Fix

**Type:** Upgrade version

**Origin:** 

**Release Date:** 

**Fix Resolution :** 


</details>

<details>
  <summary>
 🟣CVE-2021-44906
  </summary>

### Vulnerable Library - **minimist-0.0.8.tgz**

parse argument options

**Library home page:** [ https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz ](https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz)







**Dependency Hierarchy:**


- actions-toolkit-2.0.0.tgz (Root Library)
    - flat-cache-2.0.1.tgz
        - write-1.0.3.tgz
            - mkdirp-0.5.1.tgz
                - ❌  **minimist-0.0.8.tgz** (Vulnerable Library)


- actions-toolkit-2.1.0.tgz (Root Library)
    - flat-cache-2.0.1.tgz
        - write-1.0.3.tgz
            - mkdirp-0.5.1.tgz
                - ❌  **minimist-0.0.8.tgz** (Vulnerable Library)


- jest-24.9.0.tgz (Root Library)
    - jest-cli-24.9.0.tgz
        - core-24.9.0.tgz
            - jest-haste-map-24.9.0.tgz
                - fsevents-1.2.9.tgz
                    - node-pre-gyp-0.12.0.tgz
                        - mkdirp-0.5.1.tgz
                            - ❌  **minimist-0.0.8.tgz** (Vulnerable Library)


- actions-toolkit-2.2.0.tgz (Root Library)
    - flat-cache-2.0.1.tgz
        - write-1.0.3.tgz
            - mkdirp-0.5.1.tgz
                - ❌  **minimist-0.0.8.tgz** (Vulnerable Library)


- nock-11.7.0.tgz (Root Library)
    - mkdirp-0.5.1.tgz
        - ❌  **minimist-0.0.8.tgz** (Vulnerable Library)




***

### Reachability Analysis
The vulnerable code is unreachable
***

### Vulnerability Details

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

**Publish Date:** Mar 17, 2022 01:05 PM

**URL:** [ CVE-2021-44906 ](https://www.mend.io/vulnerability-database/CVE-2021-44906)

**Threat Assessment**

Exploit Maturity:Not Defined

EPSS:< 1%

**Score:** 9.3


***
### Suggested Fix

**Type:** Upgrade version

**Origin:** https://github.com/advisories/GHSA-xvch-5gv4-984h

**Release Date:** Mar 17, 2022 01:05 PM

**Fix Resolution :** minimist - 0.2.4,minimist - 1.2.6


</details>

<details>
  <summary>
 🔴CVE-2020-8203
  </summary>

### Vulnerable Library - **lodash-4.17.15.tgz**

Lodash modular utilities.

**Library home page:** [ https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz ](https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz)







**Dependency Hierarchy:**


- jest-24.9.0.tgz (Root Library)
    - jest-cli-24.9.0.tgz
        - jest-config-24.9.0.tgz
            - jest-environment-jsdom-24.9.0.tgz
                - jsdom-11.12.0.tgz
                    - request-promise-native-1.0.8.tgz
                        - request-promise-core-1.1.3.tgz
                            - ❌  **lodash-4.17.15.tgz** (Vulnerable Library)


- nock-11.7.0.tgz (Root Library)
    - ❌  **lodash-4.17.15.tgz** (Vulnerable Library)




***

### Reachability Analysis
The vulnerable code is unreachable
***

### Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

**Publish Date:** Jul 15, 2020 04:10 PM

**URL:** [ CVE-2020-8203 ](https://www.mend.io/vulnerability-database/CVE-2020-8203)

**Threat Assessment**

Exploit Maturity:Not Defined

EPSS:2.4%

**Score:** 8.3


***
### Suggested Fix

**Type:** Upgrade version

**Origin:** https://github.com/advisories/GHSA-p6mc-m468-83gw

**Release Date:** Jul 15, 2020 04:10 PM

**Fix Resolution :** lodash - 4.17.19,lodash-es - 4.17.20


</details>

<details>
  <summary>
 🔴CVE-2021-23337
  </summary>

### Vulnerable Library - **lodash-4.17.15.tgz**

Lodash modular utilities.

**Library home page:** [ https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz ](https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz)







**Dependency Hierarchy:**


- jest-24.9.0.tgz (Root Library)
    - jest-cli-24.9.0.tgz
        - jest-config-24.9.0.tgz
            - jest-environment-jsdom-24.9.0.tgz
                - jsdom-11.12.0.tgz
                    - request-promise-native-1.0.8.tgz
                        - request-promise-core-1.1.3.tgz
                            - ❌  **lodash-4.17.15.tgz** (Vulnerable Library)


- nock-11.7.0.tgz (Root Library)
    - ❌  **lodash-4.17.15.tgz** (Vulnerable Library)




***

### Reachability Analysis
The vulnerable code is unreachable
***

### Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

**Publish Date:** Feb 15, 2021 12:15 PM

**URL:** [ CVE-2021-23337 ](https://www.mend.io/vulnerability-database/CVE-2021-23337)

**Threat Assessment**

Exploit Maturity:Proof of concept

EPSS:< 1%

**Score:** 7.3


***
### Suggested Fix

**Type:** Upgrade version

**Origin:** https://github.com/advisories/GHSA-35jh-r3h4-6jhm

**Release Date:** Feb 15, 2021 12:15 PM

**Fix Resolution :** lodash-es - 4.17.21,lodash - 4.17.21


</details>

<details>
  <summary>
 🔴CVE-2020-7751
  </summary>

### Vulnerable Library - **pathval-1.1.0.tgz**

Object value retrieval given a string path

**Library home page:** [ https://registry.npmjs.org/pathval/-/pathval-1.1.0.tgz ](https://registry.npmjs.org/pathval/-/pathval-1.1.0.tgz)







**Dependency Hierarchy:**


- nock-11.7.0.tgz (Root Library)
    - chai-4.2.0.tgz
        - ❌  **pathval-1.1.0.tgz** (Vulnerable Library)




***

### Reachability Analysis
The vulnerable code is unreachable
***

### Vulnerability Details

pathval before version 1.1.1 is vulnerable to prototype pollution.

**Publish Date:** Oct 25, 2020 03:55 PM

**URL:** [ CVE-2020-7751 ](https://www.mend.io/vulnerability-database/CVE-2020-7751)

**Threat Assessment**

Exploit Maturity:Not Defined

EPSS:< 1%

**Score:** 7.0


***
### Suggested Fix

**Type:** Upgrade version

**Origin:** https://github.com/advisories/GHSA-g6ww-v8xp-vmwg

**Release Date:** Oct 25, 2020 03:55 PM

**Fix Resolution :** pathval - 1.1.1


</details>

<details>
  <summary>
 🟠CVE-2020-7598
  </summary>

### Vulnerable Library - **minimist-0.0.8.tgz**

parse argument options

**Library home page:** [ https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz ](https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz)







**Dependency Hierarchy:**


- actions-toolkit-2.0.0.tgz (Root Library)
    - flat-cache-2.0.1.tgz
        - write-1.0.3.tgz
            - mkdirp-0.5.1.tgz
                - ❌  **minimist-0.0.8.tgz** (Vulnerable Library)


- actions-toolkit-2.1.0.tgz (Root Library)
    - flat-cache-2.0.1.tgz
        - write-1.0.3.tgz
            - mkdirp-0.5.1.tgz
                - ❌  **minimist-0.0.8.tgz** (Vulnerable Library)


- jest-24.9.0.tgz (Root Library)
    - jest-cli-24.9.0.tgz
        - core-24.9.0.tgz
            - jest-haste-map-24.9.0.tgz
                - fsevents-1.2.9.tgz
                    - node-pre-gyp-0.12.0.tgz
                        - mkdirp-0.5.1.tgz
                            - ❌  **minimist-0.0.8.tgz** (Vulnerable Library)


- actions-toolkit-2.2.0.tgz (Root Library)
    - flat-cache-2.0.1.tgz
        - write-1.0.3.tgz
            - mkdirp-0.5.1.tgz
                - ❌  **minimist-0.0.8.tgz** (Vulnerable Library)


- nock-11.7.0.tgz (Root Library)
    - mkdirp-0.5.1.tgz
        - ❌  **minimist-0.0.8.tgz** (Vulnerable Library)




***

### Reachability Analysis
The vulnerable code is unreachable
***

### Vulnerability Details

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "proto" payload.
 Mend Note: The description of this vulnerability differs from MITRE. 

**Publish Date:** Mar 11, 2020 09:40 PM

**URL:** [ CVE-2020-7598 ](https://www.mend.io/vulnerability-database/CVE-2020-7598)

**Threat Assessment**

Exploit Maturity:Not Defined

EPSS:< 1%

**Score:** 6.3


***
### Suggested Fix

**Type:** Upgrade version

**Origin:** https://github.com/advisories/GHSA-vh95-rmgr-6w4m

**Release Date:** Mar 11, 2020 09:40 PM

**Fix Resolution :** minimist - 1.2.3,minimist - 0.2.1


</details>

<details>
  <summary>
 🟠CVE-2020-28500
  </summary>

### Vulnerable Library - **lodash-4.17.15.tgz**

Lodash modular utilities.

**Library home page:** [ https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz ](https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz)







**Dependency Hierarchy:**


- jest-24.9.0.tgz (Root Library)
    - jest-cli-24.9.0.tgz
        - jest-config-24.9.0.tgz
            - jest-environment-jsdom-24.9.0.tgz
                - jsdom-11.12.0.tgz
                    - request-promise-native-1.0.8.tgz
                        - request-promise-core-1.1.3.tgz
                            - ❌  **lodash-4.17.15.tgz** (Vulnerable Library)


- nock-11.7.0.tgz (Root Library)
    - ❌  **lodash-4.17.15.tgz** (Vulnerable Library)




***

### Reachability Analysis
The vulnerable code is unreachable
***

### Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions. After conducting further research, Mend has determined that CVE-2020-28500 only affects environments with versions 4.0.0 to 4.17.20 of Lodash.

**Publish Date:** Feb 15, 2021 11:10 AM

**URL:** [ CVE-2020-28500 ](https://www.mend.io/vulnerability-database/CVE-2020-28500)

**Threat Assessment**

Exploit Maturity:Proof of concept

EPSS:< 1%

**Score:** 5.5


***
### Suggested Fix

**Type:** Upgrade version

**Origin:** https://github.com/advisories/GHSA-29mw-wpgm-hmr9

**Release Date:** Feb 15, 2021 11:10 AM

**Fix Resolution :** lodash - 4.17.21,lodash-es - 4.17.21


</details>

[comment]: <> (<MEND_ISSUE_METADATA>{"identifier":"nock-11.7.0.tgz","repoName":"github-actions","branchName":"main","type":"SCA_DEP"}</MEND_ISSUE_METADATA>)

Finding	Severity	🎯 CVSS	Exploit Maturity	EPSS	Library	Type	Fixed in	Remediation Available	Reachability
CVE-796484-931798	🟣 Critical	9.8	N/A	N/A	lodash-4.17.15.tgz	Transitive	N/A	❌
CVE-2021-44906	🟣 Critical	9.3	Not Defined	< 1%	minimist-0.0.8.tgz	Transitive	N/A	❌	Unreachable
CVE-2020-8203	🔴 High	8.3	Not Defined	2.4%	lodash-4.17.15.tgz	Transitive	N/A	❌	Unreachable
CVE-2021-23337	🔴 High	7.3	Proof of concept	< 1%	lodash-4.17.15.tgz	Transitive	N/A	❌	Unreachable
CVE-2020-7751	🔴 High	7.0	Not Defined	< 1%	pathval-1.1.0.tgz	Transitive	N/A	❌	Unreachable
CVE-2020-7598	🟠 Medium	6.3	Not Defined	< 1%	minimist-0.0.8.tgz	Transitive	N/A	❌	Unreachable
CVE-2020-28500	🟠 Medium	5.5	Proof of concept	< 1%	lodash-4.17.15.tgz	Transitive	N/A	❌	Unreachable

nock-11.7.0.tgz: 7 vulnerabilities (highest severity is: 9.8) [main] (unreachable) #22

Description

Findings

Details

Vulnerable Library - lodash-4.17.15.tgz

Vulnerability Details

Suggested Fix

Vulnerable Library - minimist-0.0.8.tgz

Reachability Analysis

Vulnerability Details

Suggested Fix

Vulnerable Library - lodash-4.17.15.tgz

Reachability Analysis

Vulnerability Details

Suggested Fix

Vulnerable Library - lodash-4.17.15.tgz

Reachability Analysis

Vulnerability Details

Suggested Fix

Vulnerable Library - pathval-1.1.0.tgz

Reachability Analysis

Vulnerability Details

Suggested Fix

Vulnerable Library - minimist-0.0.8.tgz

Reachability Analysis

Vulnerability Details

Suggested Fix

Vulnerable Library - lodash-4.17.15.tgz

Reachability Analysis

Vulnerability Details

Suggested Fix

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions