What is GHSA-3f5c-4qxj-vmpf?

GHSA-3f5c-4qxj-vmpf is a security advisory published by GitHub Security Advisories with High severity. Next.js Directory Traversal Vulnerability

Which CVE IDs does GHSA-3f5c-4qxj-vmpf cover?

GHSA-3f5c-4qxj-vmpf covers the following CVE IDs: CVE-2017-16877. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-3f5c-4qxj-vmpf?

GHSA-3f5c-4qxj-vmpf has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-3f5c-4qxj-vmpf?

GHSA-3f5c-4qxj-vmpf affects 1 product, including: npm/next:\u003e= 1.0.0, \u003c 2.4.1.

GHSA-3f5c-4qxj-vmpfHighCVSS 7.5

Next.js Directory Traversal Vulnerability

Vendor

GitHub Security Advisories

Published

December 5, 2017

Last Modified

April 22, 2024

🔗 CVE IDs covered (1)

CVE-2017-16877 →

📋 Description

Next.js before 2.4.1 has directory traversal under the /_next and /static request namespace, allowing attackers to obtain sensitive information.

🎯 Affected products1

npm/next:>= 1.0.0, < 2.4.1

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2017-16877
https://github.com/zeit/next.js/releases/tag/2.4.1
https://github.com/vercel/next.js/commit/02fe7cf63f6265d73bdaf8bc50a4f2fb539dcd00
https://github.com/advisories/GHSA-3f5c-4qxj-vmpf