CVE-2019-5484 Symlink Arbitrary File Overwrite in bower
HighCVSS 7.5
EPSS 2.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Bower before 1.8.8 has a path traversal vulnerability permitting file write in arbitrary locations via install command, which allows attackers to write arbitrary files when a malicious package is extracted.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm bower(npm) | < 1.8.8 | 1.8.8 |
| bower | < 1.8.8 | 1.8.8 |
References
- nvd.nist.gov third-party-advisory
- github.com patch
- hackerone.com exploit patch third-party-advisory
- snyk.io exploit third-party-advisory
- github.com
- www.npmjs.com
- lists.apache.org
- lists.apache.org
- github.com
- [netbeans-commits] 20200429 [jira] [Created] (NETBEANS-4280) cleanup potential security breaches mailing-list
- [netbeans-notifications] 20200429 [GitHub] [netbeans] BradWalker opened a new pull request #2110: [NETBEANS-4280] - cleanup potential security breaches mailing-list