PT-2020-19709 · Rollup · Rollup-Plugin-Dev-Server

Published 2020-07-25 · Updated 2020-07-29 · CVE-2020-7686

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions rollup-plugin-dev-server versions all

Description The issue is related to the lack of path sanitization in the readFile operation inside the readFileFromContentBase function. This could potentially lead to security issues, as it may allow unauthorized access to files.

Recommendations For all versions, consider disabling the readFileFromContentBase function until a patch is available, or restrict its use to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2020-7686

GHSA-VR98-27QJ-3C8Q

Affected Products

Rollup-Plugin-Dev-Server

References · 3

• 🔥 https://snyk.io/vuln/SNYK-JS-ROLLUPPLUGINDEVSERVER-590124 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-7686 · Security Note
• https://osv.dev/vulnerability/GHSA-vr98-27qj-3c8q · Vendor Advisory