netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish GHSA-wfm3-gq9h-mrjm

Browse Source
This commit is contained in:
advisory-database[bot]
2024-02-23 17:46:43 +00:00
parent 22f5cf2b63
commit 312fcbad66
1 changed files with 34 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/02/GHSA-wfm3-gq9h-mrjm/GHSA-wfm3-gq9h-mrjm.json → advisories/github-reviewed/2024/02/GHSA-wfm3-gq9h-mrjm/GHSA-wfm3-gq9h-mrjm.json
+34 -7
View File
@@ -1,17 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-wfm3-gq9h-mrjm",
"modified": "2024-02-23T00:30:33Z",
"modified": "2024-02-23T17:45:23Z",
"published": "2024-02-23T00:30:33Z",
"aliases": [
"CVE-2022-25377"
],
"details": "The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary local files via ../ directory traversal. In order to be vulnerable, APP_STORAGE_CERTIFICATES/.well-known/acme-challenge must exist on disk. (This pathname is automatically created if the user chooses to install Let's Encrypt certificates via Appwrite.)",
"summary": "Appwrite Directory Traversal vulnerability",
"details": "The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary local files via ../ directory traversal. In order to be vulnerable, `APP_STORAGE_CERTIFICATES/.well-known/acme-challenge` must exist on disk. (This pathname is automatically created if the user chooses to install Let's Encrypt certificates via Appwrite.)",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "appwrite/server-ce"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0.5.0"
},
{
"fixed": "0.12.2"
}
]
}
]
}
],
"references": [
{
@@ -22,10 +41,18 @@
"type": "WEB",
"url": "https://github.com/appwrite/appwrite/pull/2780"
},
{
"type": "WEB",
"url": "https://github.com/appwrite/appwrite/commit/892f6fa4ba0d44e2435ffad1a84542400cfb7a9b"
},
{
"type": "WEB",
"url": "https://dubell.io/unauthenticated-lfi-in-appwrite-0.5.0-0.12.1"
},
{
"type": "PACKAGE",
"url": "https://github.com/appwrite/appwrite"
},
{
"type": "WEB",
"url": "https://github.com/appwrite/appwrite/blob/0.12.0/app/controllers/general.php#L539"
@@ -37,11 +64,11 @@
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-02-23T17:45:23Z",
"nvd_published_at": "2024-02-22T22:15:47Z"
}
}