GHSA-9rjp-r58j-fxgq

Source

https://github.com/advisories/GHSA-9rjp-r58j-fxgq

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-9rjp-r58j-fxgq/GHSA-9rjp-r58j-fxgq.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-9rjp-r58j-fxgq

Aliases

CVE-2021-23428

Published

2021-09-02T22:05:26Z

Modified

2023-11-08T04:05:09.113597Z

Severity

8.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L CVSS Calculator

Summary

Path traversal in elFinder.NetCore

Details

This affects all versions of package elFinder.NetCore. The Path.Combine(...) method is used to create an absolute file path. Due to missing sanitation of the user input and a missing check of the generated path its possible to escape the Files directory via path traversal

Database specific

{
    "nvd_published_at": "2021-09-01T15:15:00Z",
    "github_reviewed_at": "2021-09-02T18:03:47Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-20",
        "CWE-22"
    ]
}

References

Affected packages

NuGet / elFinder.NetCore

Package

Name: elFinder.NetCore; View open source insights on deps.dev
Purl: pkg:nuget/elFinder.NetCore

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

1.3.5

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.8

1.0.9

1.1.0

1.2.1

1.2.2

1.3.0

1.3.1

1.3.2

1.3.3

1.3.4

1.3.5