Quick answers
- Is CVE-2020-7649 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2020-7649 being exploited in the wild.
- How severe is CVE-2020-7649?
- Low severity, with a CVSS score of 3.1, published 26 July 2022.
- Which products and versions are affected?
- snyk-broker (npm) SEMVER:introduced=0,fixed=4.73.0; Snyk Broker before 4.73.0.
- Is there a fix for CVE-2020-7649?
- Yes. snyk-broker (npm): upgrade to 4.73.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2020-7649 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2020-7649?
- Check whether you run snyk-broker (npm) or Snyk Broker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- snyk-broker (npm): upgrade to 4.73.0 or later
npm install snyk-broker@4.73.0
Technical details
This is a path traversal vulnerability (CWE-22) in snyk-broker before version 4.73.0 that allows unauthenticated or authenticated internal users to read arbitrary files via directory traversal sequences in file path requests. The vulnerability requires the attacker to have network access to the Snyk broker service (typically an internal network resource), but does not require special privileges or user interaction. An attacker can bypass intended file access restrictions and read sensitive files outside the intended directory scope. The fix was applied in version 4.73.0, which adds validation to reject paths containing directory traversal patterns.
Affected products
- Snyk broker before 4.73.0
Identifiers
- CVE-2020-7649
- GHSA-gq75-5gc3-rfwg
Timeline
- 2022-07-26: disclosed
- 2022-07-26: patched: Version 4.73.0 released with fix