exploitDog

CVE-2022-31507

Опубликовано: 11 июл. 2022

Источник: nvd

CVSS3: 9.3

CVSS2: 6.4

EPSS Низкий

Описание

The ganga-devs/ganga repository before 8.5.10 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.

Ссылки

https://github.com/ganga-devs/ganga/commit/730e7aba192407d35eb37dd7938d49071124be8c
Exploit
Patch
Third Party Advisory
https://github.com/ganga-devs/ganga/releases/tag/8.5.10
Release Notes
Third Party Advisory
https://github.com/github/securitylab/issues/669#issuecomment-1117265726
Exploit
Issue Tracking
Third Party Advisory
https://github.com/ganga-devs/ganga/commit/730e7aba192407d35eb37dd7938d49071124be8c
Exploit
Patch
Third Party Advisory
https://github.com/ganga-devs/ganga/releases/tag/8.5.10
Release Notes
Third Party Advisory
https://github.com/github/securitylab/issues/669#issuecomment-1117265726
Exploit
Issue Tracking
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:ganga_project:ganga:*:*:*:*:*:*:*:*

Версия до 8.5.10 (исключая)

EPSS

Процентиль: 69%

0.0059

Низкий

9.3 Critical

CVSS3

6.4 Medium

CVSS2

Дефекты

CWE-22

Связанные уязвимости

GHSA-7488-6x3r-23w5

CVSS3: 9.3

github

больше 3 лет назад

Ganga allows absolute path traversal

EPSS

Процентиль: 69%

0.0059

Низкий

9.3 Critical

CVSS3

6.4 Medium

CVSS2

Дефекты

CWE-22