3 results (0.009 seconds)

CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1

CVE-2022-1537 – file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in gruntjs/grunt

https://notcve.org/view.php?id=CVE-2022-1537

file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root. Las operaciones file.copy en GruntJS son vulnerables a una condición de carrera TOCTOU conllevando una escritura arbitraria de archivos en el repositorio de GitHub gruntjs/grunt versiones anteriores a 1.5.3. Esta vulnerabilidad es capaz de realizar escrituras arbitrarias en archivos que pueden conllevar a una escalada de privilegios local para el usuario de GruntJS si un usuario menos privilegiado presenta acceso de escritura a los directorios de origen y destino, ya que el usuario menos privilegiado puede crear un enlace simbólico al archivo .bashrc del usuario de GruntJS o reemplazar el archivo /etc/shadow si el usuario de GruntJS es root • https://github.com/gruntjs/grunt/commit/58016ffac5ed9338b63ecc2a63710f5027362bae https://huntr.dev/bounties/0179c3e5-bc02-4fc9-8491-a1a319b51b4d https://lists.debian.org/debian-lts-announce/2023/04/msg00006.html • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •

CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 1

CVE-2022-0436 – Path Traversal in gruntjs/grunt

https://notcve.org/view.php?id=CVE-2022-0436

Path Traversal in GitHub repository gruntjs/grunt prior to 1.5.2. Un Salto de Ruta en el repositorio de GitHub gruntjs/grunt versiones anteriores a 1.5.2 • https://github.com/gruntjs/grunt/commit/aad3d4521c3098fb255fb2db8f2e1d691a033665 https://huntr.dev/bounties/f55315e9-9f6d-4dbb-8c40-bae50c1ae92b https://lists.debian.org/debian-lts-announce/2023/04/msg00008.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 7.1EPSS: 0%CPEs: 3EXPL: 1

CVE-2020-7729 – Arbitrary Code Execution

https://notcve.org/view.php?id=CVE-2020-7729

The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML. El paquete grunt versiones anteriores a 1.3.0, es vulnerable a una ejecución de código arbitraria debido al uso predeterminado de la función load() en lugar de su reemplazo seguro safeLoad() del paquete js-yaml dentro de grunt.file.readYAML • https://github.com/gruntjs/grunt/blob/master/lib/grunt/file.js%23L249 https://github.com/gruntjs/grunt/commit/e350cea1724eb3476464561a380fb6a64e61e4e7 https://lists.debian.org/debian-lts-announce/2020/09/msg00008.html https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-607922 https://snyk.io/vuln/SNYK-JS-GRUNT-597546 https://usn.ubuntu.com/4595-1 • CWE-1188: Initialization of a Resource with an Insecure Default •