Lucene search
PRIOn knowledge basePRION:CVE-2021-21298HistoryFeb 26, 2021 - 5:15 p.m.
Path traversal
2021-02-2617:15:00
PRIOn knowledge base
www.prio-n.com
5
Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier has a vulnerability which allows arbitrary path traversal via the Projects API. If the Projects feature is enabled, a user with projects.read permission is able to access any file via the Projects API. The issue has been patched in Node-RED 1.2.8. The vulnerability applies only to the Projects feature which is not enabled by default in Node-RED. The primary workaround is not give untrusted users read access to the Node-RED editor.
Related
veracode
veracode
Directory Traversal
2021-03-01 05:31:30
nvd
nvd
CVE-2021-21298
2021-02-26 17:15:12
osv
osv
Path traversal in Node-Red
2021-02-26 16:31:23
CVE-2021-21298
2021-02-26 17:15:12
cve
cve
CVE-2021-21298
2021-02-26 17:15:12
github
github
Path traversal in Node-Red
2021-02-26 16:31:23
cvelist
cvelist
CVE-2021-21298 Path traversal in Node-Red
2021-02-26 16:25:14