Description

Node-RED-Dashboard before 2.26.2 allows ui_base/js/..%2f directory traversal to read files.

Remediation

References

https://github.com/node-red/node-red-dashboard/issues/669

https://github.com/node-red/node-red-dashboard/releases/tag/2.26.2

Related Vulnerabilities

CVE-2016-4567 Vulnerability in npm package mediaelement

CVE-2020-7760 Vulnerability in npm package codemirror

CVE-2015-0279 Vulnerability in maven package org.richfaces:richfaces-a4j

CVE-2019-16555 Vulnerability in maven package com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer

CVE-2017-12649 Vulnerability in maven package com.liferay:com.liferay.asset.browser.web

Severity

High

Classification

CWE-22 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Third Party Advisory Release Notes