Is CVE-2020-7652 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-7652 being exploited in the wild.

How severe is CVE-2020-7652?

Low severity, with a CVSS score of 3.1, published 3 June 2020.

Which products and versions are affected?

snyk-broker (npm) SEMVER:introduced=0,fixed=4.80.0; Snyk Broker before 4.80.0.

Is there a fix for CVE-2020-7652?

Yes. snyk-broker (npm): upgrade to 4.80.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-7652 attacked?

It is attacked over the network.

Am I affected by CVE-2020-7652?

Check whether you run snyk-broker (npm) or Snyk Broker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-7652: Snyk Broker arbitrary file read via directory traversal

CVE-2020-7652 · Severity: low · CVSS 3.1 · Published 2020-06-03

Snyk Broker is a service that securely relays communications between Snyk's cloud platform and private customer environments. An attacker with network access to the broker can read arbitrary files from the server through directory traversal, potentially exposing sensitive configuration files, credentials, or proprietary code stored alongside the broker.

Technologies: snyk-broker (npm), Snyk Broker. Vendors: npm, Snyk.

Quick answers

Is CVE-2020-7652 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-7652 being exploited in the wild.
How severe is CVE-2020-7652?: Low severity, with a CVSS score of 3.1, published 3 June 2020.
Which products and versions are affected?: snyk-broker (npm) SEMVER:introduced=0,fixed=4.80.0; Snyk Broker before 4.80.0.
Is there a fix for CVE-2020-7652?: Yes. snyk-broker (npm): upgrade to 4.80.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-7652 attacked?: It is attacked over the network.
Am I affected by CVE-2020-7652?: Check whether you run snyk-broker (npm) or Snyk Broker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

snyk-broker (npm): upgrade to 4.80.0 or later
```
npm install snyk-broker@4.80.0
```

Technical details

Snyk Broker versions before 4.80.0 contain a directory traversal vulnerability (CWE-22) in file-reading functionality. The vulnerability allows authenticated or network-adjacent attackers to bypass path restrictions and read arbitrary files on the system hosting the broker. Attack vector is network-based, requiring only low privilege access to the internal network where the broker operates. An attacker can retrieve sensitive files including credentials, keys, or application data. The vulnerability is fixed in version 4.80.0 and later.

Affected products

Snyk Broker before 4.80.0

Identifiers

CVE-2020-7652
GHSA-x7m2-6g99-84w5

Timeline

2020-06-03: disclosed
2020-06-03: patched: Fix available in version 4.80.0

References

https://github.com/snyk/broker

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.