Check logs sprint 9.1 week 2

[jason-upchurch]

Log review needs to be completed for PI planning week per the Security Event Review Checklist (https://github.com/fecgov/FEC/wiki/Security-Event-Review-Checklist)

[jason-upchurch]

Vulnerabilities found this week

FEC-CMS: Total 3

package.json: 2 HIGH, 1 MEDIUM

• Arbitrary File Overwrite: HIGH [High] Snyk: Arbitrary File Overwrite (due 6/15/19) fec-cms#2901
• Arbitrary File Overwrite: HIGH [HIGH] Arbitrary File Overwrite -- need a fix by May 10, 2019 fec-cms#2821
• Denial of Service (DoS) : MEDIUM [Med] Snyk: Denial of Service (DoS) (due 6/2/19) fec-cms#2792

requirements.txt: 1 MEDIUM

• Sandbox Escape: MEDIUM [Med] Snyk: Sandbox Escape (due 6/10/19) fec-cms#2822

OPENFEC: 0

package.json: 0

requirements.txt: 0

data/flyway/build.gradle: 0

FEC-EREGS: Total 2

package.json: 1 MEDIUM

• Prototype Pollution : MEDIUM [Med] Snyk: Prototype Pollution (due 6/10/19) fec-eregs#439

requirements.txt: 0

FEC-PATTERN-LIBRARY: Total 0

package.json: 0

Search logs: No new users added/removed

Cloud.gov Dashboard: 9 deployer accounts, same as last week.