1. Home
  2. CVE Database
  3. CVE-2022-25937
MEDIUM · 6.5

CVE-2022-25937

Versions of the package glance before 3.0.9 are vulnerable to Directory Traversal that allows users to read files outside the public root directory. This is related to but distinct from the vulnerabil...

Vulnerability Description

Versions of the package glance before 3.0.9 are vulnerable to Directory Traversal that allows users to read files outside the public root directory. This is related to but distinct from the vulnerability reported in [CVE-2018-3715](https://security.snyk.io/vuln/npm:glance:20180129).

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
Glance ProjectGlance< 3.0.9

Related Weaknesses (CWE)

CWE-22

References

FAQ

What is CVE-2022-25937?

CVE-2022-25937 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Versions of the package glance before 3.0.9 are vulnerable to Directory Traversal that allows users to read files outside the public root directory. This is related to but distinct from the vulnerabil...

How severe is CVE-2022-25937?

CVE-2022-25937 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-25937?

Check the references section above for vendor advisories and patch information. Affected products include: Glance Project Glance.