Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:npm/%40backstage/plugin-techdocs-backend@0.0.0-nightly-20230902020952
Typenpm
Namespace@backstage
Nameplugin-techdocs-backend
Version0.0.0-nightly-20230902020952
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version1.10.13
Latest_non_vulnerable_version1.10.13
Affected_by_vulnerabilities
0
url VCID-jpj8-auf5-f7cp
vulnerability_id VCID-jpj8-auf5-f7cp
summary 
@backstage/plugin-techdocs-backend storage bucket Directory Traversal vulnerability
When using the AWS S3 or GCS storage provider for TechDocs it is possible to access content in the entire storage bucket. This can leak contents of the bucket that are not intended to be accessible, as well as bypass permission checks in Backstage.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-45816.json
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-45816.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-45816
reference_id
reference_type
scores
0
value 0.00355
scoring_system epss
scoring_elements 0.58139
published_at 2026-06-08T12:55:00Z
1
value 0.00355
scoring_system epss
scoring_elements 0.58153
published_at 2026-06-07T12:55:00Z
2
value 0.00355
scoring_system epss
scoring_elements 0.58156
published_at 2026-06-05T12:55:00Z
3
value 0.00355
scoring_system epss
scoring_elements 0.58164
published_at 2026-06-06T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-45816
2
reference_url https://github.com/backstage/backstage
reference_id
reference_type
scores
0
value 7.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/backstage/backstage
3
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2312953
reference_id 2312953
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2312953
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-45816
reference_id CVE-2024-45816
reference_type
scores
0
value 7.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-45816
5
reference_url https://github.com/advisories/GHSA-39v3-f278-vj3g
reference_id GHSA-39v3-f278-vj3g
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-39v3-f278-vj3g
6
reference_url https://github.com/backstage/backstage/security/advisories/GHSA-39v3-f278-vj3g
reference_id GHSA-39v3-f278-vj3g
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
1
value 7.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
2
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
3
value HIGH
scoring_system generic_textual
scoring_elements
4
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-18T14:50:10Z/
url https://github.com/backstage/backstage/security/advisories/GHSA-39v3-f278-vj3g
fixed_packages
0
url pkg:npm/%40backstage/plugin-techdocs-backend@1.10.13
purl pkg:npm/%40backstage/plugin-techdocs-backend@1.10.13
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/%2540backstage/plugin-techdocs-backend@1.10.13
aliases CVE-2024-45816, GHSA-39v3-f278-vj3g
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-jpj8-auf5-f7cp
1
url VCID-r2bx-fd9s-ybc3
vulnerability_id VCID-r2bx-fd9s-ybc3
summary 
@backstage/plugin-techdocs-backend vulnerable to circumvention of cross site scripting protection
An attacker with control of the contents of the TechDocs storage buckets is able to inject executable scripts in the TechDocs content that will be executed in the victim's browser when browsing documentation or navigating to an attacker provided link.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-46976.json
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-46976.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-46976
reference_id
reference_type
scores
0
value 0.00185
scoring_system epss
scoring_elements 0.3997
published_at 2026-06-08T12:55:00Z
1
value 0.00185
scoring_system epss
scoring_elements 0.39997
published_at 2026-06-07T12:55:00Z
2
value 0.00185
scoring_system epss
scoring_elements 0.40022
published_at 2026-06-05T12:55:00Z
3
value 0.00185
scoring_system epss
scoring_elements 0.40025
published_at 2026-06-06T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-46976
2
reference_url https://github.com/backstage/backstage
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
1
value 4.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/backstage/backstage
3
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2312954
reference_id 2312954
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2312954
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-46976
reference_id CVE-2024-46976
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
1
value 4.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-46976
5
reference_url https://github.com/advisories/GHSA-5j94-f3mf-8685
reference_id GHSA-5j94-f3mf-8685
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-5j94-f3mf-8685
6
reference_url https://github.com/backstage/backstage/security/advisories/GHSA-5j94-f3mf-8685
reference_id GHSA-5j94-f3mf-8685
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value 4.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
3
value MODERATE
scoring_system generic_textual
scoring_elements
4
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-18T13:47:03Z/
url https://github.com/backstage/backstage/security/advisories/GHSA-5j94-f3mf-8685
fixed_packages
0
url pkg:npm/%40backstage/plugin-techdocs-backend@1.10.13
purl pkg:npm/%40backstage/plugin-techdocs-backend@1.10.13
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/%2540backstage/plugin-techdocs-backend@1.10.13
aliases CVE-2024-46976, GHSA-5j94-f3mf-8685
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-r2bx-fd9s-ybc3
Fixing_vulnerabilities
Risk_score4.0
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:npm/%2540backstage/plugin-techdocs-backend@0.0.0-nightly-20230902020952