Описание
This affects versions of package browserless-chrome before 1.40.2-chrome-stable. User input flowing from the workspace endpoint gets used to create a file path filePath and this is fetched and then sent back to a user. This can be escaped to fetch arbitrary files from a server.
Ссылки
- Broken Link
- PatchThird Party Advisory
- Release NotesThird Party Advisory
- ExploitThird Party Advisory
- Broken Link
- PatchThird Party Advisory
- Release NotesThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 1.40.2 (исключая)
cpe:2.3:a:browserless:chrome:*:*:*:*:*:node.js:*:*
EPSS
Процентиль: 61%
0.00411
Низкий
7.5 High
CVSS3
5 Medium
CVSS2
Дефекты
CWE-22
Связанные уязвимости
EPSS
Процентиль: 61%
0.00411
Низкий
7.5 High
CVSS3
5 Medium
CVSS2
Дефекты
CWE-22