icon

We found results for “

WS-2020-0147

Good to know:

icon

Date: August 18, 2020

The client software downloaded a list of servers from mozilla’s servers and created local files named after the hostname field in the json document. No verification of the content of the string was made, and it could therefore have included ‘../’ leading to path traversal. This allows an attacker in controll of mozilla’s servers to overwrite/create local files named .conf. The flaw was corrected by sanitizing the hostname field.

Language: RUST

Severity Score

Severity Score

Weakness Type (CWE)

Path Traversal

CWE-22

Top Fix

icon

Upgrade Version

Upgrade to version v0.5.0

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): LOW
Availability (A): NONE

Do you need more information?

Contact Us