GHSA-fv4g-gwpj-74gr

Source

https://github.com/advisories/GHSA-fv4g-gwpj-74gr

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-fv4g-gwpj-74gr/GHSA-fv4g-gwpj-74gr.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-fv4g-gwpj-74gr

Aliases

CVE-2024-45401
GO-2024-3119

Published

2024-09-05T16:40:41Z

Modified

2024-11-18T16:27:10Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
2.4 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H CVSS Calculator

Summary

Path traversal vulnerability in stripe-cli

Details

Impact

A vulnerability exists in stripe-cli versions 1.11.1 and higher where a plugin package containing a manifest with a malformed plugin shortname installed using the --archive-url or --archive-path flags can overwrite arbitrary files.

The update addresses the path traversal vulnerability by removing the ability to install plugins from an archive URL or path.

There has been no evidence of exploitation of this vulnerability.

Recommendation

Upgrade to stripe-cli v1.21.3.

Acknowledgements

Thank you to 0xacb and bordiez for reporting this vulnerability.

For more information

Email us at security@stripe.com

Database specific

{
    "nvd_published_at": "2024-09-05T18:15:06Z",
    "cwe_ids": [
        "CWE-22"
    ],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2024-09-05T16:40:41Z"
}

References

Affected packages

Go / github.com/stripe/stripe-cli

Package

Name: github.com/stripe/stripe-cli; View open source insights on deps.dev
Purl: pkg:golang/github.com/stripe/stripe-cli

Affected ranges

Type: SEMVER
Events: Introduced

1.11.1

Fixed

1.21.3