CVE-2020-5284
Last modified
CVE-2020-5284 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. Next.js versions before 9.3.2 have a directory traversal vulnerability. Attackers could craft special requests to access files in the dist directory (.next). EPSS estimates a 43.43% chance of exploitation in the next 30 days.
Description
Next.js versions before 9.3.2 have a directory traversal vulnerability. Attackers could craft special requests to access files in the dist directory (.next). This does not affect files outside of the dist directory (.next). In general, the dist directory only holds build assets unless your application intentionally stores other assets under this directory. This issue is fixed in version 9.3.2.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Zeit | Next.Js | < 9.3.2 |
References
- https://github.com/zeit/next.js/releases/tag/v9.3.2Release Notes
- https://github.com/zeit/next.js/security/advisories/GHSA-fq77-7p7r-83rjThird Party Advisory
- https://github.com/zeit/next.js/releases/tag/v9.3.2Release Notes
- https://github.com/zeit/next.js/security/advisories/GHSA-fq77-7p7r-83rjThird Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-5284?
How severe is CVE-2020-5284?
How do I fix CVE-2020-5284?
Are you affected by CVE-2020-5284?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST