GitHub Advisoryadvisory · npm

GHSA-54xj-q58h-9x57 Arbitrary File Write in iobroker.admin

CRITICAL Published 2020-09-04 Modified 2021-10-01 Official page ↗
Aliases
CVE-2019-10765
Ecosystem
npm
Packages
iobroker.admin
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-22
Reviewed
2020-08-31

Affected packages

• npm iobroker.admin: < 3.6.12 → fixed in 3.6.12

Description

Versions of `iobroker.admin` prior to 3.6.12 are vulnerable to Path Traversal. The package fails to restrict access to folders outside of the intended folder in the `/log/` route, which may allow attackers to include arbitrary files in the system. An attacker would need to be authenticated to perform the attack but the package has authentication disabled by default. Recommendation Upgrade to version 3.6.12 or later.

Related

Alias · CVE (1)

  • CVE-2019-10765 iobroker.admin before 3.6.12 allows attacker to include file contents from outside the `/log/file1/` directory. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References