What is GHSA-rv74-mh27-4jpv?

GHSA-rv74-mh27-4jpv is a security advisory published by GitHub Security Advisories with Medium severity. browsershot local file inclusion vulnerability

Which CVE IDs does GHSA-rv74-mh27-4jpv cover?

GHSA-rv74-mh27-4jpv covers the following CVE IDs: CVE-2020-7790. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rv74-mh27-4jpv?

GHSA-rv74-mh27-4jpv has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-rv74-mh27-4jpv?

GHSA-rv74-mh27-4jpv affects 1 product, including: composer/spatie/browsershot:\u003c 3.40.1.

GHSA-rv74-mh27-4jpvMediumCVSS 5.3

browsershot local file inclusion vulnerability

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

February 1, 2024

🔗 CVE IDs covered (1)

CVE-2020-7790 →

📋 Description

This affects the package spatie/browsershot from 0.0.0. By specifying a URL in the file:// protocol an attacker is able to include arbitrary files in the resultant PDF.

🎯 Affected products1

composer/spatie/browsershot:< 3.40.1

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2020-7790
https://github.com/spatie/browsershot/issues/441%23issue-735049731
https://snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-1037064
https://github.com/spatie/browsershot/pull/440
https://github.com/spatie/browsershot/commit/8d4bcfb1ff609921007f3fc11d80fcdad35598ac
https://github.com/advisories/GHSA-rv74-mh27-4jpv