Description

In blynk-server in Blynk before 0.39.7, Directory Traversal exists via a ../ in a URI that has /static or /static/js at the beginning, as demonstrated by reading the /etc/passwd file.

Remediation

References

https://github.com/blynkkk/blynk-server/issues/1256

https://github.com/blynkkk/blynk-server/releases/tag/v0.39.7

Related Vulnerabilities

CVE-2020-28273 Vulnerability in npm package set-in

CVE-2012-1833 Vulnerability in maven package org.grails:grails-core

CVE-2018-17421 Vulnerability in maven package com.zrlog:zrlog

CVE-2023-26136 Vulnerability in maven package org.webjars.bowergithub.salesforce:tough-cookie

CVE-2021-36686 Vulnerability in npm package yapi-vendor

Severity

High

Classification

CWE-22 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Exploit Issue Tracking Third Party Advisory Vendor Advisory