Directory Traversal
CVE-2020-7649

4.9MEDIUM

Key Information:

Vendor

Snyk

Status
Snyk-broker
Vendor
CVE Published:
25 July 2022

What is CVE-2020-7649?

This affects the package snyk-broker before 4.73.0. It allows arbitrary file reads for users with access to Snyk's internal network via directory traversal.

Affected Version(s)

snyk-broker < 4.73.0

References

https://security.snyk.io/vuln/SNYK-JS-SNYKBROKER-570608
x_refsource_MISC
https://github.com/snyk/broker/commit/90e0bac07a800b7c4c6...
x_refsource_MISC
https://updates.snyk.io/snyk-broker-security-fixes-152338
x_refsource_MISC

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wing Chan of The Hut Group
.