GitHub Advisoryadvisory · npm

GHSA-2fmp-7xwf-wvwr Arbitrary File Read in Snyk Broker

MEDIUM Published 2020-06-03 Modified 2021-07-29 Official page ↗
Aliases
CVE-2020-7650
Ecosystem
npm
Packages
snyk-broker
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2020-06-01

Affected packages

• npm snyk-broker: < 4.73.1 → fixed in 4.73.1

Description

All versions of snyk-broker after 4.72.0 including and before 4.73.1 are vulnerable to Arbitrary File Read. It allows arbitrary file reads to users with access to Snyk's internal network of any files ending in the following extensions: yaml, yml or json.

Related

Alias · CVE (1)

  • CVE-2020-7650 All versions of snyk-broker after 4.72.0 including and before 4.73.1 are vulnerable to Arbitrary File Read. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References