Lucene search

SnykCVE-2020-7649

HistoryJul 25, 2022 - 2:15 p.m.

CVE-2020-7649

2022-07-2514:15:09

CWE-22

snyk

web.nvd.nist.gov

cve-2020-7649

snyk-broker

arbitrary file reads

directory traversal

nvd

CVSS3

4.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

50.8%

JSON

This affects the package snyk-broker before 4.73.0. It allows arbitrary file reads for users with access to Snyk’s internal network via directory traversal.

Affected configurations

Nvd

Node

snykbrokerRange<4.73.0node.js

VendorProductVersionCPE
snykbroker*cpe:2.3:a:snyk:broker:*:*:*:*:*:node.js:*:*

Vendor	Product	Version	CPE
snyk	broker	*	cpe:2.3:a:snyk:broker::::::node.js::*

CNA Affected

[
  {
    "product": "snyk-broker",
    "vendor": "n/a",
    "versions": [
      {
        "lessThan": "4.73.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

github.com/snyk/broker/commit/90e0bac07a800b7c4c6646097c9c89d6b878b429

security.snyk.io/vuln/SNYK-JS-SNYKBROKER-570608

updates.snyk.io/snyk-broker-security-fixes-152338

Social References

CVSS3

4.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

50.8%

JSON

Related for CVE-2020-7649