Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2020-7649

This affects the package snyk-broker before 4.73.0. It allows arbitrary file reads for users with access to Snyk's internal network via directory traversal.

VectorNETWORK

PublishedJul 25, 2022, 14:15

Published Byreport@snyk.io

Base Score

Score4.9

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

snyk-broker(npm)04.73.0N/A

References

https://github.com/snyk/broker/commit/90e0bac07a800b7c4c6646097c9c89d6b878b429
https://security.snyk.io/vuln/SNYK-JS-SNYKBROKER-570608
https://updates.snyk.io/snyk-broker-security-fixes-152338

Weakness Type

CWE-22

CVSS Metrics

Base Score

4.9

Vector String

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Base SeverityMedium

Version

3.1

Attack Vector (AV)

NETWORK