CVE-2019-10767
Arbitrary File Write in iobroker.js-controller
概要
Arbitrary File Write in iobroker.js-controller
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Versions of iobroker.controller prior to 2.0.25 are vulnerable to Path Traversal. The package fails to restrict access to folders outside of the intended /adapter/ folder, which may allow attackers to include arbitrary files in the system. An attacker would need to be authenticated to perform the attack but the package has authentication disabled by default.
Recommendation
Upgrade to version 2.0.25 or later.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
npm
iobroker.js-controller
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.25"}]}]
参照URL
- advisory nvd.nist.gov
- web github.com
- web snyk.io
- web npmjs.com