En resumen
- CVE-2021-21298 es una vulnerabilidad MEDIO (CVSS 6.5) que afecta a node-red (nodered), @node-red/runtime.
- Probabilidad de explotación en los próximos 30 días (EPSS): 1.1%, mayor que el 65.1% de las vulnerabilidades.
- Solución: actualizar a 1.2.8 o posterior.
Description
Impact
This vulnerability allows arbitrary path traversal via the Projects API.
If the Projects feature is enabled, a user with projects.read permission is able to access any file via the Projects API.
Patches
The issue has been patched in Node-RED 1.2.8
Workarounds
The vulnerability applies only to the Projects feature which is not enabled by default in Node-RED.
The primary workaround is not give untrusted users read access to the Node-RED editor.
For more information
If you have any questions or comments about this advisory:
Acknowledgements
Thanks to the Tencent Woodpecker Security Team for disclosing this vulnerability.
NVD description
Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier has a vulnerability which allows arbitrary path traversal via the Projects API. If the Projects feature is enabled, a user with `projects.read` permission is able to access any file via the Projects API. The issue has been patched in Node-RED 1.2.8. The vulnerability applies only to the Projects feature which is not enabled by default in Node-RED. The primary workaround is not give untrusted users read access to the Node-RED editor.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free