CVE-2023-47440 Vulnerability in npm package gladys

Description

Gladys Assistant v4.27.0 and prior is vulnerable to Directory Traversal. The patch of CVE-2023-43256 was found to be incomplete, allowing authenticated attackers to extract sensitive files in the host machine.

Remediation

References

https://github.com/GladysAssistant/Gladys/pull/1918/commits/4f56ba250ff9f46578f1afa6a97e62e74bad83b7

https://blog.moku.fr/cve/

https://blog.moku.fr/cves/CVE-2023-47440/

Related Vulnerabilities

CVE-2022-0437 Vulnerability in npm package karma

CVE-2019-10746 Vulnerability in maven package org.webjars.npm:mixin-deep

CVE-2021-25329 Vulnerability in maven package org.apache.tomcat:tomcat-catalina

CVE-2021-23341 Vulnerability in maven package org.webjars:prismjs

CVE-2020-7647 Vulnerability in maven package io.jooby:jooby

Severity

High

Classification

CWE-22 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N