CVE-2021-21298

creationtimestamp| type| source ---|---|--- 2021-02-26 20:39:23+00:00| seen| https://t.me/cibsecurity/24239...

@dolittle/node-red (>=2.0.0, <=2.2.8), @dolittle/node-red-infor-m3 (>=2.0.0, <=2.2.8) +13 more potentially affected by CVE-2021-21298 via @node-red/runtime (>=1.0.0, <=1.2.7)

@node-red/runtime NPM version =1.0.0, =2.0.0, =2.0.0, =7.0.0, =1.2.0, =0.1.1, =1.0.0-beta.1, =0.0.1, =0.0.3, =0.0.5, =0.0.2, =1.0.4, =1.0.1, =1.0.2 Source cves: CVE-2021-21298 Source advisory: OSV:GHSA-M33V-338H-4V9F...

CVE-2021-21298 Path traversal in Node-Red

Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier has a vulnerability which allows arbitrary path traversal via the Projects API. If the Projects feature is enabled, a user with projects.read permission is able to access any file via t...