GHSA-2p62-c4rm-mr72: 
JavaScript vulnerability analysis and mitigation

A critical security vulnerability was identified in the npm package another-date-picker, specifically in version 2.0.43. The vulnerability was discovered on May 15, 2018, and was published to the GitHub Advisory Database on September 1, 2020. This malicious package affected the another-date-picker library, which is a date picker component for web applications (GitHub Advisory, Snyk Report).

The vulnerability has been assigned a Critical severity rating with a CVSS score of 9.8. The CVSS metrics indicate Network attack vector, Low attack complexity, No privileges required, No user interaction needed, Unchanged scope, and High impact on Confidentiality, Integrity, and Availability. The vulnerability is tracked as GHSA-2p62-c4rm-mr72 and is classified under CWE-506 (GitHub Advisory).

When executed in the browser, the malicious code would enumerate and extract sensitive information from form fields, specifically targeting password, CVC, and card number fields. The extracted data would then be transmitted to a remote server at js-metrics.com/minjs.php?pl=, potentially leading to unauthorized access to users' financial and personal information (GitHub Advisory, Snyk Report).

The vulnerability has a proof-of-concept or detailed explanation of how to exploit it, making it highly exploitable. The attack requires no special privileges or user interaction, and can be executed remotely over the network (Snyk Report).

Users are advised to replace version 2.0.43 with either a version before or after 2.0.43, with version 2.0.45 being identified as a patched version. Additionally, it is recommended to evaluate applications for potential compromise of user data if the vulnerable version was previously installed (GitHub Advisory).