PT-2021-14376 · Keymaker · Keymaker

Published 2021-01-20 · Updated 2021-01-27 · CVE-2021-21269

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Keymaker versions prior to 0.2.0

Description: The issue concerns a path traversal attack due to insufficient checking of user input in the join method, potentially allowing access to more files than intended. This is related to the assets endpoint not verifying file extensions.

Recommendations: For versions prior to 0.2.0, update to version 0.2.0 to resolve the issue. As a temporary workaround, consider restricting access to the assets endpoint until the update can be applied.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-21269

GHSA-PG25-XFCF-VJVM

Affected Products

Keymaker

References · 4

• ❌ https://github.com/keymaker-mx/keymaker/commit/63f3012b390ff1519a84100df9e5dff5058bb926 · Patch, Deleted
• https://osv.dev/vulnerability/CVE-2021-21269 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21269 · Security Note
• ❌ https://github.com/keymaker-mx/keymaker/security/advisories/GHSA-pg25-xfcf-vjvm · Note, Deleted