CVE-2021-32662
CVE-2021-32662 · TechDocs mkdocs.yml path traversal
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In `@backstage/techdocs-common` versions prior to 0.6.3, a malicious actor could read sensitive files from the environment where TechDocs documentation is built and published by setting a particular path for `docs_dir` in `mkdocs.yml`. These files would then be available over the TechDocs backend API. This vulnerability is mitigated by the fact that an attacker would need access to modify the `mkdocs.yml` in the documentation source code, and would also need access to the TechDocs backend API. The vulnerability is patched in the `0.6.3` release of `@backstage/techdocs-common`.
CVSS 6.5 · Media · EPSS 1,3% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node
Productos y versiones afectados
backstage
- Versiones
- < 0.6.3: Afectada
Sin corrección publicada
@backstage/techdocs-common npm
- Intervalos de versiones afectados
- SEMVER: < 0.6.3
Actualiza a 0.6.3