Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-nzah-s38n-xub4
Summary
Information Exposure
snyk-broker allows arbitrary file reads to users with access to Snyk's internal network for any files ending with the following extensions: `.yaml`, `.yml` or `json`.
Aliases
0
alias CVE-2020-7650
1
alias GHSA-2fmp-7xwf-wvwr
Fixed_packages
0
url pkg:npm/snyk-broker@4.73.1
purl pkg:npm/snyk-broker@4.73.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-581p-rh6t-uqeu
1
vulnerability VCID-j98t-ahrh-jkfb
2
vulnerability VCID-n26x-qjyj-juf7
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/snyk-broker@4.73.1
Affected_packages
0
url pkg:npm/snyk-broker@4.72.0
purl pkg:npm/snyk-broker@4.72.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9j-x88b-5qb1
1
vulnerability VCID-4rqx-m8z2-xyfx
2
vulnerability VCID-581p-rh6t-uqeu
3
vulnerability VCID-j98t-ahrh-jkfb
4
vulnerability VCID-n26x-qjyj-juf7
5
vulnerability VCID-nzah-s38n-xub4
6
vulnerability VCID-y4up-bu4b-vqb9
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/snyk-broker@4.72.0
1
url pkg:npm/snyk-broker@4.72.1
purl pkg:npm/snyk-broker@4.72.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9j-x88b-5qb1
1
vulnerability VCID-4rqx-m8z2-xyfx
2
vulnerability VCID-581p-rh6t-uqeu
3
vulnerability VCID-j98t-ahrh-jkfb
4
vulnerability VCID-n26x-qjyj-juf7
5
vulnerability VCID-nzah-s38n-xub4
6
vulnerability VCID-y4up-bu4b-vqb9
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/snyk-broker@4.72.1
2
url pkg:npm/snyk-broker@4.72.2
purl pkg:npm/snyk-broker@4.72.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1b9j-x88b-5qb1
1
vulnerability VCID-581p-rh6t-uqeu
2
vulnerability VCID-j98t-ahrh-jkfb
3
vulnerability VCID-n26x-qjyj-juf7
4
vulnerability VCID-nzah-s38n-xub4
5
vulnerability VCID-y4up-bu4b-vqb9
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/snyk-broker@4.72.2
3
url pkg:npm/snyk-broker@4.73.0
purl pkg:npm/snyk-broker@4.73.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-581p-rh6t-uqeu
1
vulnerability VCID-j98t-ahrh-jkfb
2
vulnerability VCID-n26x-qjyj-juf7
3
vulnerability VCID-nzah-s38n-xub4
4
vulnerability VCID-y4up-bu4b-vqb9
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/snyk-broker@4.73.0
References
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2020-7650
reference_id
reference_type
scores
0
value 0.00393
scoring_system epss
scoring_elements 0.60614
published_at 2026-06-06T12:55:00Z
1
value 0.00393
scoring_system epss
scoring_elements 0.60602
published_at 2026-06-07T12:55:00Z
2
value 0.00393
scoring_system epss
scoring_elements 0.60608
published_at 2026-06-05T12:55:00Z
3
value 0.00393
scoring_system epss
scoring_elements 0.60559
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2020-7650
1
reference_url https://snyk.io/vuln/SNYK-JS-SNYKBROKER-570609
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://snyk.io/vuln/SNYK-JS-SNYKBROKER-570609
2
reference_url https://updates.snyk.io/snyk-broker-security-fixes-152338
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://updates.snyk.io/snyk-broker-security-fixes-152338
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2020-7650
reference_id CVE-2020-7650
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2020-7650
4
reference_url https://github.com/advisories/GHSA-2fmp-7xwf-wvwr
reference_id GHSA-2fmp-7xwf-wvwr
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-2fmp-7xwf-wvwr
Weaknesses
0
cwe_id 1035
name OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
1
cwe_id 200
name Exposure of Sensitive Information to an Unauthorized Actor
description The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
2
cwe_id 937
name OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.
3
cwe_id 22
name Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Exploits
Severity_range_score4.0 - 6.9
Exploitability0.5
Weighted_severity6.2
Risk_score3.1
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-nzah-s38n-xub4