CVE-2024-45816CWE-23

Storage bucket Directory Traversal in @backstage/plugin-techdocs-backend

Medium · published September 17, 2024

CVSS v3.1
6.5
EPSS
1%
Percentile
53.6
In the wild
Unconfirmed
What it is

Backstage is an open framework for building developer portals. When using the AWS S3 or GCS storage provider for TechDocs it is possible to access content in the entire storage bucket. This can leak contents of the bucket that are not intended to be accessible, as well as bypass permission checks in Backstage. This has been fixed in the 1.10.13 release of the `@backstage/plugin-techdocs-backend` package. All users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00728 · 53.6th percentile
Weakness
CWE-23 · Relative Path Traversal
Published
2024-09-17T20:13Z
EPSS history
Timeline
  • 17 SEP 20:13Z
    Storage bucket Directory Traversal in @backstage/plugin-techdocs-backend
    cvelistv5