Path Traversal in droppy · CVE-2020-7757 · GitHub Advisory Database · GitHub

Path Traversal in droppy

Moderate severity GitHub Reviewed Published May 10, 2021 to the GitHub Advisory Database • Updated Feb 1, 2023

Package

droppy (npm)

Affected versions

<= 12.2.0

Patched versions

None

Description

This affects all versions of package droppy. It is possible to traverse directories to fetch configuration files from a droopy server.

References

Published by the National Vulnerability Database

Nov 2, 2020

Reviewed Apr 20, 2021

Published to the GitHub Advisory Database May 10, 2021

Last updated Feb 1, 2023

Severity

Moderate

6.5

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N