GHSA-6324-52pr-h4p5: Using the directory back payload (“/../”) in a package name allows placement of package in other folders.

Skip to content

Sign in

CVE-2023-49089

• • Actions

    Automate any workflow

  • Packages

    Host and manage packages

  • Security

    Find and fix vulnerabilities

  • Codespaces

    Instant dev environments

  • Copilot

    Write better code with AI

  • Code review

    Manage code changes

  • Issues

    Plan and track work

  • Discussions

    Collaborate outside of code

Explore

*   All features
*   Documentation
*   GitHub Skills
*   Blog

• For

  • Enterprise
  • Teams
  • Startups
  • Education

  By Solution

  • CI/CD & Automation
  • DevOps
  • DevSecOps

  Resources

  • Learning Pathways
  • White papers, Ebooks, Webinars
  • Customer Stories
  • Partners

• • GitHub Sponsors

    Fund open source developers

*   The ReadME Project
    
    GitHub community articles
    

Repositories

*   Topics
*   Trending
*   Collections

• Pricing

Search code, repositories, users, issues, pull requests…

Provide feedback

We read every piece of feedback, and take your input very seriously.

Include my email address so I can be contacted

Saved searches****Use saved searches to filter your results more quickly

Sign in

Sign up

1. GitHub Advisory Database
2. GitHub Reviewed
3. CVE-2023-49089

Using the directory back payload (“/…/”) in a package name allows placement of package in other folders.

Low severity GitHub Reviewed Published Dec 12, 2023 in umbraco/Umbraco-CMS

Vulnerability details Dependabot alerts 0

Package

nuget Umbraco.CMS (NuGet)

Affected versions

>= 8.0.0, < 8.18.10

>= 9.0.0, < 10.8.1

>= 11.0.0, < 12.3.4

Patched versions

8.18.10

10.8.1

12.3.4

Description

Impact

Backoffice users with permissions to create packages can use path traversal and thereby write outside of the expected location.

References

• GHSA-6324-52pr-h4p5
• https://nvd.nist.gov/vuln/detail/CVE-2023-49089

bergmania published to umbraco/Umbraco-CMS

Dec 12, 2023

Published by the National Vulnerability Database

Dec 12, 2023

Published to the GitHub Advisory Database

Dec 13, 2023

Reviewed

Dec 13, 2023

Severity

Low

0.0

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

None

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:N

Weaknesses

CWE-22

CVE ID

CVE-2023-49089

GHSA ID

GHSA-6324-52pr-h4p5

Source code

umbraco/Umbraco-CMS

Checking history

See something to contribute? Suggest improvements for this vulnerability.