medium6.5
CVE-2022-25937
Path traversal vulnerability in glance
Impact
Versions of the package glance before 3.0.9 are vulnerable to Directory Traversal that allows users to read files outside the public root directory. This is related to but distinct from the vulnerability reported in [CVE-2018-3715](https://security.snyk.io/vuln/npm:glance:20180129).
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | glance | < 3.0.9 | 3.0.9 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Glance Project | Glance | before 3.0.9 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/jarofghosts/glance/commit/8cecfe90286e0c45a5494067f1b592d0ccfeabac
- https://security.snyk.io/vuln/SNYK-JS-GLANCE-3318395
- https://github.com/advisories/GHSA-3hjh-5hgx-f5wh
- https://nvd.nist.gov/vuln/detail/CVE-2022-25937
- https://gist.github.com/lirantal/c8cfb0398c78e558b7d4ac02aae67809