CVE-2023-35844

packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow .

High · published June 19, 2023

CVSS v3.1
7.5
EPSS
6%
Percentile
93.6
In the wild
Unconfirmed
What it is

packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow .. directory traversal and do not ensure that an intended file extension (.csv or .png) is used.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.06344 · 93.6th percentile
Published
2023-06-19T00:00Z
EPSS history
Timeline
  • 19 JUN 00:00Z
    packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow .
    cvelistv5