GHSA-6452-jr93-r5qm

Source

https://github.com/advisories/GHSA-6452-jr93-r5qm

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-6452-jr93-r5qm/GHSA-6452-jr93-r5qm.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-6452-jr93-r5qm

Aliases

CVE-2019-13915
GO-2023-1924

Published

2022-05-24T16:50:40Z

Modified

2024-08-20T20:58:42.020236Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

b3log Wide unauthenticated file access

Details

b3log Wide before 1.6.0 allows three types of attacks to access arbitrary files. First, the attacker can write code in the editor, and compile and run it approximately three times to read an arbitrary file. Second, the attacker can create a symlink, and then place the symlink into a ZIP archive. An unzip operation leads to read access, and write access (depending on file permissions), to the symlink target. Third, the attacker can import a Git repository that contains a symlink, similarly leading to read and write access.

Database specific

{
    "nvd_published_at": "2019-07-18T15:15:00Z",
    "cwe_ids": [
        "CWE-59",
        "CWE-74"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-14T21:08:41Z"
}

References

Affected packages

Go / github.com/b3log/wide

Package

Name: github.com/b3log/wide; View open source insights on deps.dev
Purl: pkg:golang/github.com/b3log/wide

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.6.0