CVE-2024-47829

Katalog CVE

CVSS 6.5 · Medium EPSS 0,23%

Kerentanan Use of Weak Hash pada pnpm. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

pnpm is a package manager. Prior to version 10.0.0, the path shortening function uses the md5 function as a path shortening compression function, and if a collision occurs, it will result in the same storage path for two different libraries. Although the real names are under the package name /node_modoules/, there are no version numbers for the libraries they refer to. This issue has been patched in version 10.0.0.

Rincian

Terbit di NVD

23 April 2025

Terakhir diubah

22 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-328: Use of Weak Hash

EPSS (30 hari)

0,23% peluang dieksploitasi; lebih tinggi dari 12,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pnpm/pnpm/security/advisories/GHSA-8cc4-rfj6-fhg4 exploit · advisory vendor