CVE-2020-7648

2020-05-2921:06:49

snyk

www.cve.org

EPSS

0.001

Percentile

48.5%

JSON

All versions of snyk-broker before 4.72.2 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users who have access to Snyk’s internal network by appending the URL with a fragment identifier and a whitelisted path e.g. #package.json

CNA Affected

[
  {
    "product": "snyk-broker",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "All versions before 4.72.2"
      }
    ]
  }
]

References

snyk.io/vuln/SNYK-JS-SNYKBROKER-570607

updates.snyk.io/snyk-broker-security-fixes-152338

EPSS

0.001

Percentile

48.5%

JSON

Related for CVELIST:CVE-2020-7648