CVE-2022-25937

Summary

Versions of the package glance before 3.0.9 are vulnerable to Directory Traversal that allows users to read files outside the public root directory. This is related to but distinct from the vulnerability reported in CVE-2018-3715.

Affected Software

Weaknesses

• CWE-22: Directory Traversal

ADP Enrichment

CVE Program Container

Additional References

• https://security.snyk.io/vuln/SNYK-JS-GLANCE-3318395
• https://github.com/jarofghosts/glance/commit/8cecfe90286e0c45a5494067f1b592d0ccfeabac

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

References

• https://security.snyk.io/vuln/SNYK-JS-GLANCE-3318395
• https://github.com/jarofghosts/glance/commit/8cecfe90286e0c45a5494067f1b592d0ccfeabac

• ←Previous
• Next→