Lucene search

[email protected]NVD:CVE-2020-21525

HistorySep 30, 2020 - 6:15 p.m.

CVE-2020-21525

2020-09-3018:15:24

CWE-22

[email protected]

web.nvd.nist.gov

halo v1.1.3

arbitrary file reading

directory traversal check

input path parameter

startswith function bypass

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.006

Percentile

78.7%

JSON

Halo V1.1.3 is affected by: Arbitrary File reading. In an interface that reads files in halo v1.1.3, a directory traversal check is performed on the input path parameter, but the startsWith function can be used to bypass it.

Affected configurations

Nvd

Node

halohaloMatch1.1.3

VendorProductVersionCPE
halohalo1.1.3cpe:2.3:a:halo:halo:1.1.3:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
halo	halo	1.1.3	cpe:2.3:a:halo:halo:1.1.3:::::::*

References

github.com/halo-dev/halo/issues/420

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.006

Percentile

78.7%

JSON

Related for NVD:CVE-2020-21525

cve1 cvelist1 prion1