What is GHSA-2rq5-699j-x7p6?

GHSA-2rq5-699j-x7p6 is a security advisory published by GitHub Security Advisories with High severity. Arbitrary local file read vulnerability during template rendering

Which CVE IDs does GHSA-2rq5-699j-x7p6 cover?

GHSA-2rq5-699j-x7p6 covers the following CVE IDs: CVE-2023-25345. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2rq5-699j-x7p6?

GHSA-2rq5-699j-x7p6 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-2rq5-699j-x7p6?

GHSA-2rq5-699j-x7p6 affects 2 products, including: npm/swig-templates:\u003c= 2.0.4; npm/swig:\u003c= 1.4.2.

GHSA-2rq5-699j-x7p6HighCVSS 7.5

Arbitrary local file read vulnerability during template rendering

Vendor

GitHub Security Advisories

Published

March 15, 2023

Last Modified

March 20, 2023

🔗 CVE IDs covered (1)

CVE-2023-25345 →

📋 Description

Directory traversal vulnerability in swig-templates thru 2.0.4 and swig thru 1.4.2, allows attackers to read arbitrary files via the include or extends tags.

🎯 Affected products2

npm/swig-templates:<= 2.0.4
npm/swig:<= 1.4.2

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2023-25345
https://github.com/node-swig/swig-templates/issues/88
https://github.com/advisories/GHSA-2rq5-699j-x7p6