CVE-2020-5284

moderate-risk
Published 2020-03-30

Next.js versions before 9.3.2 have a directory traversal vulnerability. Attackers could craft special requests to access files in the dist directory (.next). This does not affect files outside of the dist directory (.next). In general, the dist directory only holds build assets unless your application intentionally stores other assets under this directory. This issue is fixed in version 9.3.2.

Do I need to act?

!
82.0% chance of exploitation in next 30 days
EPSS score — higher than 18% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.4/10 Medium
NETWORK / HIGH complexity

Affected Products (1)

Affected Vendors

Zeit

References (4)

Release Notes https://github.com/zeit/next.js/releases/tag/v9.3.2
Third Party Advisory https://github.com/zeit/next.js/security/advisories/GHSA-fq77-7p7r-83rj
Release Notes https://github.com/zeit/next.js/releases/tag/v9.3.2
Third Party Advisory https://github.com/zeit/next.js/security/advisories/GHSA-fq77-7p7r-83rj
39
/ 100
moderate-risk
Severity 14/34 · Moderate
Exploitability 20/34 · Moderate
Exposure 5/34 · Minimal