CVE-2020-16260

7.5

HIGHCVSS v3

Published

October 28, 2020

CVSS v2

5 MEDIUM

Affected

3 projects

Assigned by

MITRE

Severity scale

010

Description

Winston 1.5.4 devices do not enforce authorization. This is exploitable from the intranet, and can be combined with other vulnerabilities for remote exploitation.

winston

NPMA logger for just about everything.

all versionsNVD

winstonjs/winston

GitHubA logger for just about everything.

all versionsNVD

@types/winston

NPM

More on this CVE

NVD↗GitHub Advisory↗

Stub TypeScript definitions entry for winston, which provides its own types definitions

all versionsNVD

Security Advisories

CVE-2020-16260

Description

More on this CVE