CVE-2022-39215
MEDIUM5.8EPSS 0.45%`tauri`'s `readDir` endpoint allows possible enumeration outside of filesystem scope
發布日:2022/9/16修改日:2023/11/8
描述
It is possible for `readDir` to incorrectly enumerate files from a symlinked directory if called recursively when specifying an empty string for the dir parameter as outlined in [this](https://github.com/tauri-apps/tauri/issues/4882) issue. This is corrected in [this](https://github.com/tauri-apps/tauri/pull/5123) PR by checking if a directory is a symlink before reading from it.
受影響套件(2)
- crates.io/taurifrom 0, < 1.0.6
- crates.io/tauri>= 0.0.0-0, < 1.0.6
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM5.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N |
參考連結(10)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2022-39215
- PATCHhttps://crates.io/crates/tauri
- PATCHhttps://github.com/tauri-apps/tauri
- WEBhttps://github.com/tauri-apps/tauri/commit/bb178829086e80916f9be190f02d83bc25802799
- WEBhttps://github.com/tauri-apps/tauri/issues/4882
- WEBhttps://github.com/tauri-apps/tauri/pull/5123
- WEBhttps://github.com/tauri-apps/tauri/pull/5123/commits/1f9b9e8d26a2c915390323e161020bcb36d44678
- WEBhttps://github.com/tauri-apps/tauri/releases/tag/tauri-v1.0.6
- WEBhttps://github.com/tauri-apps/tauri/security/advisories/GHSA-28m8-9j7v-x499
- WEBhttps://rustsec.org/advisories/RUSTSEC-2022-0088.html