CVE-2022-0355 reported in Trivy scan of cypress version 13.3.3

[eagle-txec]

Current behavior

installed version 3.1.0

Desired behavior

Upgrade the version 4.0.1, 3.1.1, 2.8.2

Test code to reproduce

Cypress Version

13.3.3

Node version

16.20.2

Operating System

Debug Logs

VulnerabilityID	:	CVE-2022-0355
InstalledVersion	:	3.1.0
LastModifiedDate	:	2023-08-02T09:15:00Z
	75		{19}
	CVSS		{3}
	nvd		{4}
V2Score	:	5
V3Score	:	7.5
V2Vector	:	AV:N/AC:L/Au:N/C:P/I:N/A:N
V3Vector	:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
	ghsa		{2}
V3Score	:	7.5
V3Vector	:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
	redhat		{2}
V3Score	:	7.5
V3Vector	:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
	Layer		{1}
DiffID	:	sha256:e2ddedde812d03ee158150d58a19d4458068fc655e610b0b0e3e95b10b30c6af
PkgID	:	[email protected]
Title	:	exposure of sensitive information to an unauthorized actor
	CweIDs		[1]
0	:	CWE-212
Status	:	fixed
PkgName	:	simple-get
PkgPath	:	src/.artifacts/.cache/Cypress/13.3.3/Cypress/resources/app/node_modules/simple-get/package.json
Severity	:	HIGH
	DataSource		{3}
ID	:	ghsa
URL	:	https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm
Name	:	GitHub Security Advisory npm
PrimaryURL	:	https://avd.aquasec.com/nvd/cve-2022-0355
	References		[10]
0	:	https://access.redhat.com/security/cve/CVE-2022-0355
1	:	https://github.com/advisories/GHSA-wpg7-2c88-r8xv
2	:	https://github.com/feross/simple-get/
3	:	https://github.com/feross/simple-get/commit/e4af095e06cd69a9235013e8507e220a79b9684f
4	:	https://github.com/feross/simple-get/pull/75#issuecomment-1027755026
5	:	https://github.com/feross/simple-get/pull/76#issuecomment-1027754710
6	:	https://huntr.dev/bounties/42c79c23-6646-46c4-871d-219c0d4b4e31
7	:	https://huntr.dev/bounties/42c79c23-6646-46c4-871d-219c0d4b4e31/
8	:	https://nvd.nist.gov/vuln/detail/CVE-2022-0355
9	:	https://www.cve.org/CVERecord?id=CVE-2022-0355
Description	:	Improper Removal of Sensitive Information Before Storage or Transfer in NPM simple-get prior to 4.0.1.\n\n
FixedVersion	:	4.0.1, 3.1.1, 2.8.2
PublishedDate	:	2022-01-26T04:15:00Z
SeveritySource	:	ghsa
VulnerabilityID	:	CVE-2022-0355
InstalledVersion	:	3.1.0
LastModifiedDate	:	2023-08-02T09:15:00Z

Other

[eagle-txec]

"VulnerabilityID": "CVE-2022-0355",
"InstalledVersion": "3.1.0",
"LastModifiedDate": "2023-08-02T09:15:00Z"
},
{
"CVSS": {
"nvd": {
"V2Score": 5,
"V3Score": 7.5,
"V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
"ghsa": {
"V3Score": 7.5,
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
"redhat": {
"V3Score": 7.5,
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
},
"Layer": {
"DiffID": "sha256:e2ddedde812d03ee158150d58a19d4458068fc655e610b0b0e3e95b10b30c6af"
},
"PkgID": "[email protected]",
"Title": "exposure of sensitive information to an unauthorized actor",
"CweIDs": [
"CWE-212"
],
"Status": "fixed",
"PkgName": "simple-get",
"PkgPath": "src/.artifacts/.cache/Cypress/13.3.3/Cypress/resources/app/node_modules/simple-get/package.json",
"Severity": "HIGH",
"DataSource": {
"ID": "ghsa",
"URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm",
"Name": "GitHub Security Advisory npm"
},
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-0355",
"References": [
"https://access.redhat.com/security/cve/CVE-2022-0355",
"https://github.com/advisories/GHSA-wpg7-2c88-r8xv",
"https://github.com/feross/simple-get/",
"https://github.com/feross/simple-get/commit/e4af095e06cd69a9235013e8507e220a79b9684f",
"https://github.com/feross/simple-get/pull/75#issuecomment-1027755026",
"https://github.com/feross/simple-get/pull/76#issuecomment-1027754710",
"https://huntr.dev/bounties/42c79c23-6646-46c4-871d-219c0d4b4e31",
"https://huntr.dev/bounties/42c79c23-6646-46c4-871d-219c0d4b4e31/",
"https://nvd.nist.gov/vuln/detail/CVE-2022-0355",
"https://www.cve.org/CVERecord?id=CVE-2022-0355"
],
"Description": "Improper Removal of Sensitive Information Before Storage or Transfer in NPM simple-get prior to 4.0.1.\n\n",
"FixedVersion": "4.0.1, 3.1.1, 2.8.2",
"PublishedDate": "2022-01-26T04:15:00Z",
"SeveritySource": "ghsa",
"VulnerabilityID": "CVE-2022-0355",
"InstalledVersion": "3.1.0",
"LastModifiedDate": "2023-08-02T09:15:00Z"

[cypress-app-bot]

This issue has not had any activity in 180 days. Cypress evolves quickly and the reported behavior should be tested on the latest version of Cypress to verify the behavior is still occurring. It will be closed in 14 days if no updates are provided.

[cypress-app-bot]

This issue has been closed due to inactivity.