CVE-2022-25937 Path traversal vulnerability in glance
An attacker can read files outside the public root directory in the glance Node.js library, potentially exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-25937?
CVE-2022-25937 is a medium-severity path traversal vulnerability in glance, published on 13 Feb 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Versions of the package glance before 3.0.9 are vulnerable to Directory Traversal that allows users to read files outside the public root directory. This is related to but distinct from the vulnerability reported in [CVE-2018-3715](https://security.snyk.io/vuln/npm:glance:20180129).
Weakness: CWE-22
Which versions are affected by CVE-2022-25937?
2 open source packages ship an affected version, including glance. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
glance npm | All versions | 3.0.9 |
glance npm | All versions | 3.0.9 |
Products include Glance Project Glance.
How do I fix CVE-2022-25937?
Upgrade glance to 3.0.9 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-25937 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-25937 exists.
Other vulnerabilities in glance
Sources
Also known as GHSA-3hjh-5hgx-f5wh.