PT-2023-24355 · Wrangler · Wrangler

Mskowroncf + 1 · Publicado 2023-08-03 · Atualizado 2023-08-29 · CVE-2023-3348

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Média

Vetor base

AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Wrangler versions 3.1.0 and earlier, Wrangler versions 2.20.1 and earlier

Description The issue is related to a directory traversal vulnerability that occurs when running a local development server for Pages using the wrangler pages dev command. This vulnerability allows an attacker on the same network as the victim to connect to the local development server and access files outside of the development server directory.

Recommendations For Wrangler versions 3.1.0 and earlier, update to a version later than 3.1.0 to resolve the issue. For Wrangler versions 2.20.1 and earlier, update to a version later than 2.20.1 to resolve the issue. As a temporary workaround, consider restricting access to the local development server to minimize the risk of exploitation.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2023-3348

GHSA-8C93-4HCH-XGXP

Produtos afetados

Wrangler

Referências · 10

• https://github.com/cloudflare/workers-sdk · Nota
• https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-8c93-4hch-xgxp · Aviso do Fabricante
• https://github.com/cloudflare/workers-sdk/pull/3498 · Nota
• https://github.com/cloudflare/workers-sdk/releases/tag/wrangler%403.1.1 · Nota
• https://github.com/cloudflare/workers-sdk/commit/fddffdf0c23d2ca56f2139a2c6bc278052594cba · Nota
• https://developers.cloudflare.com/workers/wrangler · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-3348 · Nota de Segurança
• https://t.me/cibsecurity/67696 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-3348 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-8c93-4hch-xgxp · Aviso do Fabricante