CVE-2023-35844

Katalog CVE

CVSS 7.5 · High EPSS 6,3%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada lightdash. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow .. directory traversal and do not ensure that an intended file extension (.csv or .png) is used.

Rincian

Terbit di NVD

19 Juni 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

6,3% peluang dieksploitasi; lebih tinggi dari 93,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/lightdash/lightdash/commit/fcc808c84c2cc3afb343063e32a49440d32a553c patch
• https://github.com/lightdash/lightdash/pull/5090 patch
• https://advisory.dw1.io/59 exploit · advisory pihak ketiga
• https://github.com/lightdash/lightdash/compare/0.510.2...0.510.3 release notes