GHSA-rwv8-jvff-jq28

Source

https://github.com/advisories/GHSA-rwv8-jvff-jq28

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/07/GHSA-rwv8-jvff-jq28/GHSA-rwv8-jvff-jq28.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-rwv8-jvff-jq28

Aliases

CVE-2018-3731

Published

2018-07-18T21:20:30Z

Modified

2023-11-08T04:00:17.793218Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Path Traversal in public

Details

Versions of public before 0.1.3 are vulnerable to path traversal. This is due to lack of file path sanitization which could lead to any file the parent process has access to on the server to be read by malicious user.

Recommendation

Update to version 0.1.3 or later.

Database specific

{
    "cwe_ids": [
        "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:56:15Z",
    "nvd_published_at": "2018-06-07T02:29:00Z",
    "severity": "HIGH"
}

References

Affected packages

npm / public

Package

Name: public; View open source insights on deps.dev
Purl: pkg:npm/public

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.1.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/07/GHSA-rwv8-jvff-jq28/GHSA-rwv8-jvff-jq28.json"

last_known_affected_version_range

"<= 0.1.2"