CVE-2021-29474

🗓️ 26 Apr 2021 21:37:29Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 44 Views🌐 WEB

HedgeDoc (formerly CodiMD) allows arbitrary file read and relative path traversal through improper input validation, leading to an attacker's ability to read and observe changes to `.md` files on the server's filesystem

Reporter	Title	Published	Views	Family All 7
CNNVD	HedgeDoc 路径遍历漏洞	26 Apr 202100:00	–	cnnvd
Cvelist	CVE-2021-29474 Relative Path Traversal Attack on note creation	26 Apr 202121:37	–	cvelist
EUVD	EUVD-2021-16082	7 Oct 202500:30	–	euvd
NVD	CVE-2021-29474	26 Apr 202122:15	–	nvd
Prion	Path traversal	26 Apr 202122:15	–	prion
Positive Technologies	PT-2021-18238 · Hedgedoc · Hedgedoc	26 Apr 202100:00	–	ptsecurity
RedhatCVE	CVE-2021-29474	22 May 202521:24	–	redhatcve

NVD

Vulners

Node

hedgedoc hedgedocRange<1.8.0

[
  {
    "product": "hedgedoc",
    "vendor": "hedgedoc",
    "versions": [
      {
        "status": "affected",
        "version": "< 1.8.0"
      }
    ]
  }
]

Source	Link
github	www.github.com/hedgedoc/hedgedoc/security/advisories/GHSA-p528-555r-pf87

Parameter	Position	Path	Description	CWE
alias	path	/..%2F..%2FREADME	Path traversal via reserved alias in path leading to reading arbitrary .md files on the server (e.g., README)	CWE-22, CWE-20

21 Nov 2024 06:01Current

5.1Medium risk

Vulners AI Score5.1

CVSS 25

CVSS 3.14.7 - 5.8

EPSS0.00277