GHSA-p6mr-pxg4-68hx

Suggest an improvement
Source
https://github.com/advisories/GHSA-p6mr-pxg4-68hx
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/09/GHSA-p6mr-pxg4-68hx/GHSA-p6mr-pxg4-68hx.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-p6mr-pxg4-68hx
Aliases
Published
2019-09-17T23:21:34Z
Modified
2023-11-01T04:51:00Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
Symlink Arbitrary File Overwrite in bower
Details

Versions of bower prior to 1.8.8 are affected by an arbitrary file write vulnerability. The vulnerability occurs because bower does not verify that extracted symbolic links do not resolve to targets outside of the extraction root directory.

Recommendation

Update to version 1.8.8 or later

Database specific 
{
    "cwe_ids":  [
        "CWE-22"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2019-09-17T23:21:00Z",
    "nvd_published_at":  "2019-09-13T18:15:00Z",
    "severity":  "HIGH"
}
References

Affected packages

npm / bower

Package

Name
bower
View open source insights on deps.dev
Purl
pkg:npm/bower

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.8.8

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/09/GHSA-p6mr-pxg4-68hx/GHSA-p6mr-pxg4-68hx.json"