GHSA-c79f-pqgf-fhp3

Directory Traversal in Gladys Assistant

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-47440

Packages

Ecosystem	Package	Affected	Fixed in
npm	gladys	<= 4.27.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Gladys Assistant v4.27.0 and prior is vulnerable to Directory Traversal. The patch of CVE-2023-43256 was found to be incomplete, allowing authenticated attackers to extract sensitive files in the host machine.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-47440 advisory
https://github.com/GladysAssistant/Gladys/pull/1918/commits/4f56ba250ff9f46578f1afa6a97e62e74bad83b7 web
https://blog.moku.fr/cve web
https://blog.moku.fr/cves/CVE-2023-47440 web
https://github.com/GladysAssistant/Gladys package