Description

iobroker.admin before 3.6.12 allows attacker to include file contents from outside the `/log/file1/` directory.

Remediation

References

https://github.com/ioBroker/ioBroker.admin/commit/16b2b325ab47896090bc7f54b77b0a97ed74f5cd

https://snyk.io/vuln/SNYK-JS-IOBROKERADMIN-534634

Related Vulnerabilities

CVE-2021-23344 Vulnerability in npm package total.js

CVE-2021-23406 Vulnerability in npm package pac-resolver

CVE-2021-23448 Vulnerability in npm package config-handler

CVE-2021-23392 Vulnerability in npm package locutus

CVE-2022-22912 Vulnerability in npm package plist

Severity

Critical

Classification

CWE-22 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Patch Third Party Advisory Exploit