CVE-2020-7790 - Arbitrary File Read

Back Back to CVE browser

MEDIUM

Arbitrary File Read

Published Dec 11, 2020

5.3

MEDIUM

CVSS 3.1

EPSS 1.03%

Description

This affects the package spatie/browsershot from 0.0.0. By specifying a URL in the file:// protocol an attacker is able to include arbitrary files in the resultant PDF.

Affected products

Vendor n/a Product Spatie/browsershot Default
n/a
- Version
  0.0.0
  Status
  affected
  Constraints
  <unspecified

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Spatie/browsershot

n/a

Version	Status	Constraints
0.0.0	affected	<unspecified

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (7)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-5235
Advisory
https://github.com/advisories/GHSA-rv74-mh27-4jpv
Advisory
https://github.com/spatie/browsershot/commit/8d4bcfb1ff609921007f3fc11d80fcdad35598ac
https://github.com/spatie/browsershot/issues/441%23issue-735049731
x_refsource_MISCBroken Link
https://github.com/spatie/browsershot/pull/440
https://nvd.nist.gov/vuln/detail/CVE-2020-7790
https://snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-1037064
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-5235		Advisory
https://github.com/advisories/GHSA-rv74-mh27-4jpv		Advisory
https://github.com/spatie/browsershot/commit/8d4bcfb1ff609921007f3fc11d80fcdad35598ac
https://github.com/spatie/browsershot/issues/441%23issue-735049731		x_refsource_MISCBroken Link
https://github.com/spatie/browsershot/pull/440
https://nvd.nist.gov/vuln/detail/CVE-2020-7790
https://snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-1037064		x_refsource_MISCThird Party Advisory