GHSA-crf7-fvjx-863q

Source

https://github.com/advisories/GHSA-crf7-fvjx-863q

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-crf7-fvjx-863q/GHSA-crf7-fvjx-863q.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-crf7-fvjx-863q

Published

2020-09-03T17:09:26Z

Modified

2020-08-31T18:44:37Z

Summary

Path Traversal in zero

Details

Versions of zero prior to 1.0.6 are vulnerable to Path Traversal. Due to insufficient input sanitization in URLs, attackers can access server files by using relative paths when fetching files.

Recommendation

Upgrade to version 1.0.6 or later.

Database specific

{
    "cwe_ids":  [
        "CWE-22"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-08-31T18:44:37Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

https://www.npmjs.com/advisories/1025

Affected packages

npm / zero

Package

Name: zero; View open source insights on deps.dev
Purl: pkg:npm/zero

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.0.6

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-crf7-fvjx-863q/GHSA-crf7-fvjx-863q.json"