Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-8mfc-v7wv-p62g

Опубликовано: 09 фев. 2022
Источник: github
Github: Прошло ревью
CVSS3: 7.5

Описание

Path Traversal in Yarn

Arbitrary filesystem write vulnerability in Yarn 1.21.1 and earlier allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.

Пакеты

Наименование

yarn

npm
Затронутые версииВерсия исправления

<= 1.21.1

1.22.0

EPSS

Процентиль: 92%
0.05159
Низкий

7.5 High

CVSS3

Дефекты

CWE-22

Связанные уязвимости

CVSS3: 7.5
ubuntu
больше 6 лет назад

Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.

CVSS3: 7.5
redhat
больше 6 лет назад

Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.

CVSS3: 7.5
nvd
больше 6 лет назад

Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.

CVSS3: 7.5
debian
больше 6 лет назад

Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows ...

EPSS

Процентиль: 92%
0.05159
Низкий

7.5 High

CVSS3

Дефекты

CWE-22