| Package | Affected versions | Patched versions |
|---|---|---|
| changedetection-io | < 0.47.5 | 0.47.5 |
When a WebDriver is used to fetch files source:file:///etc/passwd can be used to retrieve local system files, where the more traditional file:///etc/passwd gets blocked
The root cause is the payload source:file:///etc/passwdpasses the regex here and also passes the check here where a traditional file:///etc/passwd would get blocked
CL-ChangeDetection.io Path Travsersal-311024-181039.pdf
It depends on where the webdriver is deployed but generally this is a high impact vulnerability
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free