Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-dds7-1e15-eqh8

Summary

Improper Link Resolution Before File Access ('Link Following')
Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM when reading the script file (typically Jenkinsfile) for Pipelines, allowing attackers able to configure Pipelines to read arbitrary files on the Jenkins controller file system.

Aliases

alias	CVE-2022-25176

alias	GHSA-6473-gqrj-4p65

Fixed_packages

url	pkg:maven/org.jenkins-ci.plugins.workflow/workflow-cps@2648.2651.v230593e03e9f
purl	pkg:maven/org.jenkins-ci.plugins.workflow/workflow-cps@2648.2651.v230593e03e9f
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.plugins.workflow/workflow-cps@2648.2651.v230593e03e9f

Affected_packages

url pkg:maven/org.jenkins-ci.plugins.workflow/workflow-cps@2648.va9433432b33c

purl pkg:maven/org.jenkins-ci.plugins.workflow/workflow-cps@2648.va9433432b33c

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-5fp9-6s1m-4yee

vulnerability	VCID-dds7-1e15-eqh8

vulnerability	VCID-p2ed-vf9a-rqab

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.plugins.workflow/workflow-cps@2648.va9433432b33c

References

reference_url	https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2613
reference_id
reference_type
scores
url	https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2613

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2022-25176
reference_id	CVE-2022-25176
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2022-25176

reference_url	https://github.com/advisories/GHSA-6473-gqrj-4p65
reference_id	GHSA-6473-gqrj-4p65
reference_type
scores
url	https://github.com/advisories/GHSA-6473-gqrj-4p65

Weaknesses

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

cwe_id	59
name	Improper Link Resolution Before File Access ('Link Following')
description	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

Exploits

Severity_range_score null

Exploitability null

Weighted_severity null

Risk_score null

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-dds7-1e15-eqh8

Vulnerability Instance