GHSA-2fmp-7xwf-wvwr

Source

https://github.com/advisories/GHSA-2fmp-7xwf-wvwr

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/06/GHSA-2fmp-7xwf-wvwr/GHSA-2fmp-7xwf-wvwr.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-2fmp-7xwf-wvwr

Aliases

CVE-2020-7650

Published

2020-06-03T22:02:16Z

Modified

2024-05-19T02:24:18.207019Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Arbitrary File Read in Snyk Broker

Details

All versions of snyk-broker after 4.72.0 including and before 4.73.1 are vulnerable to Arbitrary File Read. It allows arbitrary file reads to users with access to Snyk's internal network of any files ending in the following extensions: yaml, yml or json.

Database specific

{
    "nvd_published_at": "2020-05-29T22:15:00Z",
    "github_reviewed_at": "2020-06-01T19:41:38Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-22"
    ]
}

References

Affected packages

npm / snyk-broker

Package

Name: snyk-broker; View open source insights on deps.dev
Purl: pkg:npm/snyk-broker

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.73.1