Lucene search

GitHub Advisory DatabaseGHSA-W6CX-QG2Q-RVQ8

HistoryMar 01, 2022 - 10:09 p.m.

Path Traversal in @finastra/ssr-pages

2022-03-0122:09:18

CWE-22

GitHub Advisory Database

github.com

path traversal

finastra/ssr-pages

untrusted input

build function

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

7.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

EPSS

0.001

Percentile

29.4%

JSON

A path traversal issue can occur when providing untrusted input to the svg property as an argument to the build(MessagePageOptions) function.

References

Affected configurations

Vulners

Node

finastrassr-pagesRange<0.1.4

VendorProductVersionCPE
finastrassr-pages*cpe:2.3:a:finastra:ssr-pages:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
finastra	ssr-pages	*	cpe:2.3:a:finastra:ssr-pages::::::::

References

github.com/advisories/GHSA-w6cx-qg2q-rvq8

github.com/Finastra/ssr-pages/pull/1

github.com/Finastra/ssr-pages/pull/1/commits/c3e4c563384ae3ba3892f37dd190218577620780

github.com/Finastra/ssr-pages/security/advisories/GHSA-w6cx-qg2q-rvq8

nvd.nist.gov/vuln/detail/CVE-2022-24718

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

7.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

EPSS

0.001

Percentile

29.4%

JSON

Related for GHSA-W6CX-QG2Q-RVQ8