CVE-2020-5284

{"containers": {"cna": {"affected": [{"product": "next.js", "vendor": "zeit", "versions": [{"status": "affected", "version": "< 9.3.2"}]}], "descriptions": [{"lang": "en", "value": "Next.js versions before 9.3.2 have a directory traversal vulnerability. Attackers could craft special requests to access files in the dist directory (.next). This does not affect files outside of the dist directory (.next). In general, the dist directory only holds build assets unless your application intentionally stores other assets under this directory. This issue is fixed in version 9.3.2."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-23", "description": "CWE-23: Relative Path Traversal", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-03-30T20:40:11.000Z", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/zeit/next.js/security/advisories/GHSA-fq77-7p7r-83rj"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/zeit/next.js/releases/tag/v9.3.2"}], "source": {"advisory": "GHSA-fq77-7p7r-83rj", "discovery": "UNKNOWN"}, "title": "Directory Traversal in Next.js versions below 9.3.2", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2020-5284", "STATE": "PUBLIC", "TITLE": "Directory Traversal in Next.js versions below 9.3.2"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "next.js", "version": {"version_data": [{"version_value": "< 9.3.2"}]}}]}, "vendor_name": "zeit"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Next.js versions before 9.3.2 have a directory traversal vulnerability. Attackers could craft special requests to access files in the dist directory (.next). This does not affect files outside of the dist directory (.next). In general, the dist directory only holds build assets unless your application intentionally stores other assets under this directory. This issue is fixed in version 9.3.2."}]}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-23: Relative Path Traversal"}]}]}, "references": {"reference_data": [{"name": "https://github.com/zeit/next.js/security/advisories/GHSA-fq77-7p7r-83rj", "refsource": "CONFIRM", "url": "https://github.com/zeit/next.js/security/advisories/GHSA-fq77-7p7r-83rj"}, {"name": "https://github.com/zeit/next.js/releases/tag/v9.3.2", "refsource": "MISC", "url": "https://github.com/zeit/next.js/releases/tag/v9.3.2"}]}, "source": {"advisory": "GHSA-fq77-7p7r-83rj", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T08:22:09.087Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/zeit/next.js/security/advisories/GHSA-fq77-7p7r-83rj"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/zeit/next.js/releases/tag/v9.3.2"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2020-5284", "datePublished": "2020-03-30T20:40:11.000Z", "dateReserved": "2020-01-02T00:00:00.000Z", "dateUpdated": "2024-08-04T08:22:09.087Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "next.js", "vendor": "zeit", "versions": [{"status": "affected", "version": "< 9.3.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:zeit:next.js:*:*:*:*:*:*:*:*", "matchCriteriaId": "669B5A80-8554-4573-81A9-BFB5A974B88C", "versionEndExcluding": "9.3.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Next.js versions before 9.3.2 have a directory traversal vulnerability. Attackers could craft special requests to access files in the dist directory (.next). This does not affect files outside of the dist directory (.next). In general, the dist directory only holds build assets unless your application intentionally stores other assets under this directory. This issue is fixed in version 9.3.2."}, {"lang": "es", "value": "Next.js versiones anteriores a 9.3.2, presentan una vulnerabilidad salto de directorio. Los atacantes pueden dise\u00f1ar peticiones especiales para acceder a los archivos en el directorio dist (.next). Esto no afecta a los archivos fuera del directorio dist (.next). En general, el directorio dist solo contiene activos de compilaci\u00f3n a menos que su aplicaci\u00f3n almacene intencionalmente otros activos bajo este directorio. Este problema es corregido en la versi\u00f3n 9.3.2."}], "id": "CVE-2020-5284", "lastModified": "2026-06-17T03:21:12.070", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-03-30T22:15:15.400", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/zeit/next.js/releases/tag/v9.3.2"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/zeit/next.js/security/advisories/GHSA-fq77-7p7r-83rj"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://github.com/zeit/next.js/releases/tag/v9.3.2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/zeit/next.js/security/advisories/GHSA-fq77-7p7r-83rj"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-23"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}