Em resumo
- CVE-2021-21298 é uma vulnerabilidade MÉDIO (CVSS 6.5) que afeta node-red (nodered), @node-red/runtime.
- Chance de exploração nos próximos 30 dias (EPSS): 1.1%, maior que 65.1% das vulnerabilidades.
- Correção: atualize para 1.2.8 ou posterior.
Description
Impact
This vulnerability allows arbitrary path traversal via the Projects API.
If the Projects feature is enabled, a user with projects.read permission is able to access any file via the Projects API.
Patches
The issue has been patched in Node-RED 1.2.8
Workarounds
The vulnerability applies only to the Projects feature which is not enabled by default in Node-RED.
The primary workaround is not give untrusted users read access to the Node-RED editor.
For more information
If you have any questions or comments about this advisory:
Acknowledgements
Thanks to the Tencent Woodpecker Security Team for disclosing this vulnerability.
NVD description
Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier has a vulnerability which allows arbitrary path traversal via the Projects API. If the Projects feature is enabled, a user with `projects.read` permission is able to access any file via the Projects API. The issue has been patched in Node-RED 1.2.8. The vulnerability applies only to the Projects feature which is not enabled by default in Node-RED. The primary workaround is not give untrusted users read access to the Node-RED editor.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free