CVE-2020-7651

All versions of snyk-broker before 4.79.0 are vulnerable to Arbitrary File Read. It allows partial file reads for users who have access to Snyk's internal network via patch history from GitHub Commits API...

CVE-2020-7653

All versions of snyk-broker before 4.80.0 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users with access to Snyk's internal network by creating symlinks to match whitelisted paths...

CVE-2020-7652

All versions of snyk-broker before 4.80.0 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users with access to Snyk's internal network via directory traversal...

CVE-2020-7651

All versions of snyk-broker before 4.79.0 are vulnerable to Arbitrary File Read. It allows partial file reads for users who have access to Snyk's internal network via patch history from GitHub Commits API...

CVE-2020-7653

All versions of snyk-broker before 4.80.0 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users with access to Snyk's internal network by creating symlinks to match whitelisted paths...

CVE-2020-7652

All versions of snyk-broker before 4.80.0 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users with access to Snyk's internal network via directory traversal...

Code injection

All versions of snyk-broker before 4.80.0 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users with access to Snyk's internal network by creating symlinks to match whitelisted paths...

Directory traversal

All versions of snyk-broker before 4.80.0 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users with access to Snyk's internal network via directory traversal...

Code injection

All versions of snyk-broker before 4.79.0 are vulnerable to Arbitrary File Read. It allows partial file reads for users who have access to Snyk's internal network via patch history from GitHub Commits API...

CVE-2020-7650

All versions of snyk-broker after 4.72.0 including and before 4.73.1 are vulnerable to Arbitrary File Read. It allows arbitrary file reads to users with access to Snyk's internal network of any files ending in the following extensions: yaml, yml or json...

CVE-2020-7650

Snyk-Broker versions 4.72.0+ up to 4.73.0are vulnerable to Arbitrary File Read, exposing files ending in .yaml, .yml, or .json to users with access to Snyk’s internal network. The issue is fixed in 4.73.1 per the connected advisories; upgrade to 4.73.1 or later to mitigate.

CVE-2020-7648

All versions of snyk-broker before 4.72.2 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users who have access to Snyk's internal network by appending the URL with a fragment identifier and a whitelisted path e.g. package.json...

CVE-2020-7648

The CVE-2020-7648 vulnerability affects the Snyk-broker proxy: all versions prior to 4.72.2 are vulnerable to Arbitrary File Read. An attacker with internal-network access can read files by appending a URL fragment (e.g., #package.json) to a whitelisted path, enabling information disclosure. Affe...

CVE-2020-7651

All versions of snyk-broker before 4.79.0 are vulnerable to Arbitrary File Read. It allows partial file reads for users who have access to Snyk's internal network via patch history from GitHub Commits API...

CVE-2020-7651

Mode C: CVE-2020-7651 affects snyk-broker; all versions before 4.79.0 are vulnerable to an Arbitrary File Read. The flaw permits partial reads of internal network data via patch history from the GitHub Commits API. Root cause: insufficient access controls exposing internal resources to users with...

CVE-2020-7652

All versions of snyk-broker before 4.80.0 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users with access to Snyk's internal network via directory traversal...

CVE-2020-7652

CVE-2020-7652 affects snyk-broker prior to 4.80.0 and causes Arbitrary File Read via directory traversal for users with access to Snyk’s internal network. A fix is available in version 4.80.0 (and later).

CVE-2020-7653

All referenced sources describe a vulnerability in snyk-broker: versions before 4.80.0 are susceptible to Arbitrary File Read. The root cause is an information-disclosure flaw where an attacker could read arbitrary files by exploiting symlinks to match whitelisted internal paths, usable by users ...

CVE-2020-7653

All versions of snyk-broker before 4.80.0 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users with access to Snyk's internal network by creating symlinks to match whitelisted paths...

Arbitrary File Read

Overview snyk-broker is a package that proxies access between snyk.io and your Git repositories, such as GitHub Enterprise, GitHub.com and Bitbucket Server. Snyk Broker can also be used to enable a secure connection with your on-premise Jira deployment. Affected versions of this package are...