GitHub Advisoryadvisory · npm
GHSA-2hw7-mxvj-m455 Path traversal in Node-RED-Dashboard
HIGH
Official page ↗
- Aliases
- CVE-2021-3223
- Ecosystem
- npm
- Packages
- node-red-dashboard
- Severity
- High
- Weaknesses
- CWE-22
- Reviewed
- 2021-01-27
Affected packages
• npm node-red-dashboard: < 2.26.2 → fixed in 2.26.2
Description
In Node-RED-Dashboard before 2.26.2 there is a path traversal vulnerability. It allows ui_base/js/..%2f directory traversal to read files.
Related
Alias · CVE (1)
- CVE-2021-3223 Node-RED-Dashboard before 2.26.2 allows ui_base/js/..%2f directory traversal to read files. vulnerability
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2021-3223 advisory
- https://github.com/node-red/node-red-dashboard/issues/669 web
- https://github.com/node-red/node-red-dashboard/commit/f48f356df966f607ba3d09c27396074b81f2ae97 web
- https://github.com/node-red/node-red-dashboard/releases/tag/2.26.2 web
- https://www.npmjs.com/package/node-red-dashboard web