| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| github.com/charmbracelet/soft-serve | < 0.8.2 | 0.8.2 |
| soft serve | < 0.8.2 | 0.8.2 |
Path traversal attack gives access to existing non-admin users to access and take over other user's repositories. A malicious user then can modify, delete, and arbitrarily repositories as if they were an admin user without explicitly giving them permissions.
This is patched in v0.8.2
Single user set-ups are not affected. This only affects multi-user Soft Serve set-ups that enable repository creation for users. Otherwise, upgrading is necessary to circumvent the attack.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン