-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moment-timezone | npm | >= 0.1.0, < 0.5.35 | 0.5.35 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the URL construction logic in tasks/data-download.js where the 'src' variable was set to 'ftp://ftp.iana.org/tz/tzdata-latest.tar.gz' for latest versions. This function is part of the Grunt build process that handles sensitive tzdata downloads. The commit patched this by replacing FTP with HTTPS, confirming this was the vulnerable code path. The function's purpose (data fetching) and protocol choice directly match the CWE-319 description of cleartext transmission.