Search
Find a vulnerability
Search criteria
1 vulnerability by zeit
CVE-2020-5284 (GCVE-0-2020-5284)
Vulnerability from cvelistv5 – Published: 2020-03-30 20:40 – Updated: 2024-08-04 08:22
VLAI
EPSS
VEX
Title
Directory Traversal in Next.js versions below 9.3.2
Summary
Next.js versions before 9.3.2 have a directory traversal vulnerability. Attackers could craft special requests to access files in the dist directory (.next). This does not affect files outside of the dist directory (.next). In general, the dist directory only holds build assets unless your application intentionally stores other assets under this directory. This issue is fixed in version 9.3.2.
Severity
4.4 (Medium)
CWE
- CWE-23 - Relative Path Traversal
Assigner
GitHub_M
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/zeit/next.js/security/advisori… | x_refsource_CONFIRM |
| https://github.com/zeit/next.js/releases/tag/v9.3.2 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T08:22:09.087Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/zeit/next.js/security/advisories/GHSA-fq77-7p7r-83rj"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/zeit/next.js/releases/tag/v9.3.2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "next.js",
"vendor": "zeit",
"versions": [
{
"status": "affected",
"version": "\u003c 9.3.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Next.js versions before 9.3.2 have a directory traversal vulnerability. Attackers could craft special requests to access files in the dist directory (.next). This does not affect files outside of the dist directory (.next). In general, the dist directory only holds build assets unless your application intentionally stores other assets under this directory. This issue is fixed in version 9.3.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-23",
"description": "CWE-23: Relative Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-03-30T20:40:11.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/zeit/next.js/security/advisories/GHSA-fq77-7p7r-83rj"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zeit/next.js/releases/tag/v9.3.2"
}
],
"source": {
"advisory": "GHSA-fq77-7p7r-83rj",
"discovery": "UNKNOWN"
},
"title": "Directory Traversal in Next.js versions below 9.3.2",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2020-5284",
"STATE": "PUBLIC",
"TITLE": "Directory Traversal in Next.js versions below 9.3.2"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "next.js",
"version": {
"version_data": [
{
"version_value": "\u003c 9.3.2"
}
]
}
}
]
},
"vendor_name": "zeit"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Next.js versions before 9.3.2 have a directory traversal vulnerability. Attackers could craft special requests to access files in the dist directory (.next). This does not affect files outside of the dist directory (.next). In general, the dist directory only holds build assets unless your application intentionally stores other assets under this directory. This issue is fixed in version 9.3.2."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-23: Relative Path Traversal"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/zeit/next.js/security/advisories/GHSA-fq77-7p7r-83rj",
"refsource": "CONFIRM",
"url": "https://github.com/zeit/next.js/security/advisories/GHSA-fq77-7p7r-83rj"
},
{
"name": "https://github.com/zeit/next.js/releases/tag/v9.3.2",
"refsource": "MISC",
"url": "https://github.com/zeit/next.js/releases/tag/v9.3.2"
}
]
},
"source": {
"advisory": "GHSA-fq77-7p7r-83rj",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2020-5284",
"datePublished": "2020-03-30T20:40:11.000Z",
"dateReserved": "2020-01-02T00:00:00.000Z",
"dateUpdated": "2024-08-04T08:22:09.087Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}