CVE-2023-35844

Summary

packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow .. directory traversal and do not ensure that an intended file extension (.csv or .png) is used.

Affected Software

Weaknesses

• n/a

ADP Enrichment

CVE Program Container

Additional References

• https://advisory.dw1.io/59
• https://github.com/lightdash/lightdash/commit/fcc808c84c2cc3afb343063e32a49440d32a553c
• https://github.com/lightdash/lightdash/compare/0.510.2…0.510.3
• https://github.com/lightdash/lightdash/pull/5090

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

References

• https://advisory.dw1.io/59
• https://github.com/lightdash/lightdash/commit/fcc808c84c2cc3afb343063e32a49440d32a553c
• https://github.com/lightdash/lightdash/compare/0.510.2…0.510.3
• https://github.com/lightdash/lightdash/pull/5090

• ←Previous
• Next→