GHSA-4vj3-f849-5r48

Source

https://github.com/advisories/GHSA-4vj3-f849-5r48

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/06/GHSA-4vj3-f849-5r48/GHSA-4vj3-f849-5r48.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-4vj3-f849-5r48

Aliases

CVE-2020-7653

Published

2020-06-03T22:02:21Z

Modified

2024-05-08T06:58:39.858514Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Arbitrary File Read in Snyk Broker

Details

All versions of snyk-broker before 4.80.0 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users with access to Snyk's internal network by creating symlinks to match whitelisted paths.

Database specific

{
    "severity": "MODERATE",
    "github_reviewed_at": "2020-06-01T19:42:29Z",
    "nvd_published_at": "2020-05-29T21:15:00Z",
    "cwe_ids": [
        "CWE-59"
    ],
    "github_reviewed": true
}

References

Affected packages

npm / snyk-broker

Package

Name: snyk-broker; View open source insights on deps.dev
Purl: pkg:npm/snyk-broker

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.80.0