GitHub Advisoryadvisory · npm

GHSA-4vj3-f849-5r48 Arbitrary File Read in Snyk Broker

MEDIUM Published 2020-06-03 Modified 2021-07-29 Official page ↗
Aliases
CVE-2020-7653
Ecosystem
npm
Packages
snyk-broker
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-59
Reviewed
2020-06-01

Affected packages

• npm snyk-broker: < 4.80.0 → fixed in 4.80.0

Description

All versions of snyk-broker before 4.80.0 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users with access to Snyk's internal network by creating symlinks to match whitelisted paths.

Related

Alias · CVE (1)

  • CVE-2020-7653 All versions of snyk-broker before 4.80.0 are vulnerable to Arbitrary File Read. vulnerability

Weakness · CWE (1)

  • CWE-59 Improper Link Resolution Before File Access weakness

References