VulnerabilityModified
CVE-2020-7650
All versions of snyk-broker after 4.72.0 including and before 4.73.1 are vulnerable to Arbitrary File Read.
MEDIUM 6.5EPSS 1.13%
Does this matter?
Lower severity and a low EPSS score (1.13%). Track it; it rarely justifies an emergency change on its own.
Description
All versions of snyk-broker after 4.72.0 including and before 4.73.1 are vulnerable to Arbitrary File Read. It allows arbitrary file reads to users with access to Snyk's internal network of any files ending in the following extensions: yaml, yml or json.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 1.13% probability · 65th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- synk/broker
- Source
- report@snyk.io
References
- https://snyk.io/vuln/SNYK-JS-SNYKBROKER-570609Patch, Vendor Advisory
- https://updates.snyk.io/snyk-broker-security-fixes-152338Vendor Advisory
- https://snyk.io/vuln/SNYK-JS-SNYKBROKER-570609Patch, Vendor Advisory
- https://updates.snyk.io/snyk-broker-security-fixes-152338Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.