Lucene search
HistoryJun 19, 2023 - 2:15 a.m.
CVE-2023-35844
lightdash
insecure file endpoints
directory traversal
file extension
cve-2023-35844
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
0.161 Low
EPSS
Percentile
96.0%
packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow … directory traversal and do not ensure that an intended file extension (.csv or .png) is used.
Affected configurations
Node
lightdashlightdashRange<0.510.3
Related
cve
cve
CVE-2023-35844
2023-06-19 02:15:08
nuclei
nuclei
Lightdash version <= 0.510.3 Arbitrary File Read
2023-06-19 19:23:05
cvelist
cvelist
CVE-2023-35844
2023-06-19 00:00:00
osv
osv
CVE-2023-35844
2023-06-19 02:15:08
githubexploit
githubexploit
Exploit for Path Traversal in Lightdash
2023-06-26 10:14:29
prion
prion
Directory traversal
2023-06-19 02:15:00
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
0.161 Low
EPSS
Percentile
96.0%
Related for NVD:CVE-2023-35844