CVE-2021-3152 - Home Assistant before 2021.1.3 does not have a protection layer that can help to prevent directory-traversal attacks against custom integrations

Back Back to CVE browser

MEDIUM

Home Assistant before 2021.1.3 does not have a protection layer that can help to prevent directory-traversal attacks against custom integrations

Published Jan 21, 2021

5.3

MEDIUM

CVSS 3.1

EPSS 2.29%

Description

Home Assistant before 2021.1.3 does not have a protection layer that can help to prevent directory-traversal attacks against custom integrations. NOTE: the vendor's perspective is that the vulnerability itself is in custom integrations written by third parties, not in Home Assistant; however, Home Assistant does have a security update that is worthwhile in addressing this situation

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-26496
Advisory
https://www.home-assistant.io/blog/2021/01/14/security-bulletin/
x_refsource_CONFIRMVendor Advisory
https://www.home-assistant.io/blog/2021/01/22/security-disclosure/
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-26496		Advisory
https://www.home-assistant.io/blog/2021/01/14/security-bulletin/		x_refsource_CONFIRMVendor Advisory
https://www.home-assistant.io/blog/2021/01/22/security-disclosure/		x_refsource_MISCVendor Advisory