GitHub Advisoryadvisory · npm

GHSA-8c93-4hch-xgxp Cloudflare Wrangler directory traversal vulnerability

MEDIUM Published 2023-08-03 Modified 2023-08-31 Official page ↗
Aliases
CVE-2023-3348
Ecosystem
npm
Packages
wrangler
Severity
Moderate
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2023-08-03

Affected packages

• npm wrangler: < 2.20.1 → fixed in 2.20.1

Description

Impact The Wrangler command line tool (<[email protected] or <[email protected]) was affected by a directory traversal vulnerability when running a local development server for Pages (wrangler pages dev command). This vulnerability enabled an attacker in the same network as the victim to connect to the local development server and access the victim's files present outside of the directory for the development server. Patches Wrangler2: Upgrade to v2.20.1 or higher. Wrangler3: Upgrade to v3.1.1 or higher. References Workers SDK on Github Wrangler docs CVE-2023-3348

Related

Alias · CVE (1)

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References