Логотип exploitDog
bind:CVE-2022-39215
Консоль
Логотип exploitDog

exploitDog

bind:CVE-2022-39215

Количество 2

Количество 2

nvd логотип

CVE-2022-39215

почти 3 года назад

Tauri is a framework for building binaries for all major desktop platforms. Due to missing canonicalization when `readDir` is called recursively, it was possible to display directory listings outside of the defined `fs` scope. This required a crafted symbolic link or junction folder inside an allowed path of the `fs` scope. No arbitrary file content could be leaked. The issue has been resolved in version 1.0.6 and the implementation now properly checks if the requested (sub) directory is a symbolic link outside of the defined `scope`. Users are advised to upgrade. Users unable to upgrade should disable the `readDir` endpoint in the `allowlist` inside the `tauri.conf.json`.

CVSS3: 8.3
EPSS: Низкий
github логотип

GHSA-28m8-9j7v-x499

почти 3 года назад

Tauri's readDir Endpoint Scope can be Bypassed With Symbolic Links

CVSS3: 5.8
EPSS: Низкий

Уязвимостей на страницу

Уязвимость
CVSS
EPSS
Опубликовано
nvd логотип
CVE-2022-39215

Tauri is a framework for building binaries for all major desktop platforms. Due to missing canonicalization when `readDir` is called recursively, it was possible to display directory listings outside of the defined `fs` scope. This required a crafted symbolic link or junction folder inside an allowed path of the `fs` scope. No arbitrary file content could be leaked. The issue has been resolved in version 1.0.6 and the implementation now properly checks if the requested (sub) directory is a symbolic link outside of the defined `scope`. Users are advised to upgrade. Users unable to upgrade should disable the `readDir` endpoint in the `allowlist` inside the `tauri.conf.json`.

CVSS3: 8.3
0%
Низкий
почти 3 года назад
github логотип
GHSA-28m8-9j7v-x499

Tauri's readDir Endpoint Scope can be Bypassed With Symbolic Links

CVSS3: 5.8
0%
Низкий
почти 3 года назад

Уязвимостей на страницу