PT-2023-6481 · Lightdash · Lightdash
CVE-2023-35844
·
Publicado
2023-04-14
·
Atualizado
2024-12-12
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Lightdash versions prior to 0.510.3
Description
The issue is related to incorrect restriction of a directory path name with limited access. This can allow a remote attacker to gain unauthorized access to protected information. The vulnerability involves insecure file endpoints, such as allowing directory traversal and not ensuring the use of intended file extensions like .csv or .png. Approximately 78 potentially affected devices have been identified.
Recommendations
For versions prior to 0.510.3, update to version 0.510.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable file endpoints in the packages/backend/src/routers directory until a patch is applied. Avoid using the vulnerable file endpoints, which allow directory traversal, until the issue is resolved.
Exploit
Correção
Path traversal
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Lightdash