CVE-2020-7649 Directory Traversal
An attacker with internal network access can read arbitrary files via directory traversal in the Snyk broker package.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-7649?
CVE-2020-7649 is a medium-severity path traversal vulnerability in snyk-broker, published on 25 Jul 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
This affects the package snyk-broker before 4.73.0. It allows arbitrary file reads for users with access to Snyk's internal network via directory traversal.
Weakness: CWE-22
Which versions are affected by CVE-2020-7649?
2 open source packages ship an affected version, including snyk-broker. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
snyk-broker npm | All versions | 4.73.0 |
snyk-broker npm | All versions | 4.73.0 |
Products include Snyk Broker.
How do I fix CVE-2020-7649?
Upgrade snyk-broker to 4.73.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2020-7649 being exploited?
There is no known exploitation of CVE-2020-7649 in the wild and no public exploit code.
Sources
Also known as GHSA-gq75-5gc3-rfwg.