Lucene search

GitHub Advisory DatabaseGHSA-GQ75-5GC3-RFWG

HistoryJul 26, 2022 - 12:01 a.m.

snyk-broker Path Traversal before v4.73.0

2022-07-2600:01:05

CWE-22

GitHub Advisory Database

github.com

snyk-broker

path traversal

arbitrary file reads

snyk's internal network

CVSS3

4.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

50.8%

JSON

This affects the package snyk-broker before 4.73.0. It allows arbitrary file reads for users with access to Snyk’s internal network via directory traversal.

Affected configurations

Vulners

Node

snykbrokerRange<4.73.0node.js

VendorProductVersionCPE
snykbroker*cpe:2.3:a:snyk:broker:*:*:*:*:*:node.js:*:*

Vendor	Product	Version	CPE
snyk	broker	*	cpe:2.3:a:snyk:broker::::::node.js::*

References

github.com/advisories/GHSA-gq75-5gc3-rfwg

github.com/snyk/broker/commit/90e0bac07a800b7c4c6646097c9c89d6b878b429

github.com/snyk/broker/releases/tag/v4.73.0

nvd.nist.gov/vuln/detail/CVE-2020-7649

security.snyk.io/vuln/SNYK-JS-SNYKBROKER-570608

updates.snyk.io/snyk-broker-security-fixes-152338

CVSS3

4.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

50.8%

JSON

Related for GHSA-GQ75-5GC3-RFWG