Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-8mfc-v7wv-p62g

Опубликовано: 09 фев. 2022
Источник: github
Github: Прошло ревью
CVSS3: 7.5

Описание

Path Traversal in Yarn

Arbitrary filesystem write vulnerability in Yarn 1.21.1 and earlier allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.

Пакеты

Наименование

yarn

npm
Затронутые версииВерсия исправления

<= 1.21.1

1.22.0

EPSS

Процентиль: 75%
0.00897
Низкий

7.5 High

CVSS3

Дефекты

CWE-22

Связанные уязвимости

CVSS3: 7.5
ubuntu
почти 6 лет назад

Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.

CVSS3: 7.5
redhat
почти 6 лет назад

Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.

CVSS3: 7.5
nvd
почти 6 лет назад

Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.

CVSS3: 7.5
debian
почти 6 лет назад

Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows ...

EPSS

Процентиль: 75%
0.00897
Низкий

7.5 High

CVSS3

Дефекты

CWE-22