GitHub Advisoryadvisory · PyPI

GHSA-c8f7-x2g7-7fxj Phoenix-ws source code and data in extensions folder is publicly available

HIGH Published 2022-06-02 Modified 2022-10-19 Official page ↗
Ecosystem
PyPI
Packages
phoenix-ws
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2022-06-02

Affected packages

• PyPI phoenix-ws: < 1.0.6 → fixed in 1.0.6

Description

Impact All of the source code, files, and folders in `phoenix_files/extensions/` are available to end users through a simple HTTP GET request. Patches The issue has been patched. The users of version 1.0.6 and above are not effected.

Related

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References