GHSA-r49h-6qxq-624f

Suggest an improvement
Source
https://github.com/advisories/GHSA-r49h-6qxq-624f
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/07/GHSA-r49h-6qxq-624f/GHSA-r49h-6qxq-624f.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-r49h-6qxq-624f
Aliases
  • CVE-2024-7340
Published
2024-07-31T15:31:19Z
Modified
2024-08-02T16:22:35.923282Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Weave server API vulnerable to arbitrary file leak
Details

The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In various common scenarios, this allows a low-privileged user to assume the role of the server admin.

Database specific 
{
    "github_reviewed_at": "2024-07-31T20:54:48Z",
    "cwe_ids": [
        "CWE-20",
        "CWE-22"
    ],
    "nvd_published_at": "2024-07-31T15:15:11Z",
    "severity": "HIGH",
    "github_reviewed": true
}
References

Affected packages

PyPI / weave

Package

Name
weave
View open source insights on deps.dev
Purl
pkg:pypi/weave

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.50.8

Affected versions

0.*

0.20.0.dev1
0.20.0.dev2
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.26.0
0.27.0
0.28.0
0.29.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.38.0
0.39.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0
0.49.0
0.50.0
0.50.1
0.50.2
0.50.3
0.50.4
0.50.5
0.50.6
0.50.7