GHSA-v86x-f47q-f7f4

Source

https://github.com/advisories/GHSA-v86x-f47q-f7f4

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-v86x-f47q-f7f4/GHSA-v86x-f47q-f7f4.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-v86x-f47q-f7f4

Published

2020-09-11T21:09:24Z

Modified

2020-08-31T18:42:01Z

Summary

Unauthorized File Access in atompm

Details

Versions of atompm prior to 0.8.2 are vulnerable to Unauthorized File Access. The package fails to sanitize relative paths in the URL for file downloads, allowing attackers to download arbitrary files from the system.

Recommendation

Upgrade to version 0.8.2 or later.

Database specific

{
    "cwe_ids":  [
        "CWE-200"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-08-31T18:42:01Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

https://www.npmjs.com/advisories/959

Affected packages

npm / atompm

Package

Name: atompm; View open source insights on deps.dev
Purl: pkg:npm/atompm

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.8.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-v86x-f47q-f7f4/GHSA-v86x-f47q-f7f4.json"