PT-2020-7947 · Unknown · Fury-Adapter-Swagger

Published 2020-09-01 · Updated 2020-09-01 · CVE-2016-1000249

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: fury-adapter-swagger versions 0.2.0 through 0.9.7

Description: The issue allows an attacker to read arbitrary files off the system, potentially leading to the exposure of sensitive data or causing a denial of service condition by attempting to read files like /dev/zero.

Recommendations: For versions 0.2.0 through 0.9.7, upgrade to version 0.9.7 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2016-1000249

GHSA-2R7F-4H2C-5X73

Affected Products

Fury-Adapter-Swagger

References · 7

• https://osv.dev/vulnerability/GHSA-2r7f-4h2c-5x73 · Vendor Advisory
• https://github.com/apiaryio/fury-adapter-swagger · Note
• https://github.com/apiaryio/fury-adapter-swagger/commit/777e2d68f03546a88f3203bbd4725df8b1f662a7 · Note
• https://github.com/apiaryio/fury-adapter-swagger/pull/89 · Note
• https://github.com/apiaryio/fury-adapter-swagger/commit/f4407e3a5323bc31123d45dbc93b8417002e4d51#diff-54c345dc104dc19440f9c2482b7883df820e8b9b699fdd8fa07e2773e7197a29 · Note
• https://npmjs.com/advisories/305 · Note
• https://security.snyk.io/vuln/npm:fury-adapter-swagger:20161024 · Note