Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS04YzJjLWp4d2otanFnZs4AAwCy

Browsershot does not validate URL protocols passed to Browsershot URL method

Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the URL protocol passed to the Browsershot::url method.

Permalink: https://github.com/advisories/GHSA-8c2c-jxwj-jqgf
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04YzJjLWp4d2otanFnZs4AAwCy
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 1 year ago
Updated: about 1 year ago


CVSS Score: 8.2
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Identifiers: GHSA-8c2c-jxwj-jqgf, CVE-2022-41706
References: Repository: https://github.com/spatie/browsershot
Blast Radius: 24.8

Affected Packages

packagist:spatie/browsershot
Dependent packages: 57
Dependent repositories: 1,067
Downloads: 14,582,467 total
Affected Version Ranges: < 3.57.3
Fixed in: 3.57.3
All affected versions: 0.1.0, 0.1.1, 0.1.2, 0.1.3, 1.0.0, 1.1.0, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.3.0, 1.4.0, 1.5.0, 1.5.1, 1.5.2, 1.5.3, 1.5.4, 1.6.0, 1.7.0, 1.8.0, 1.9.0, 1.9.1, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.1.0, 2.2.0, 2.3.0, 2.4.0, 2.4.1, 2.4.2, 3.0.0, 3.1.0, 3.2.0, 3.2.1, 3.3.0, 3.3.1, 3.4.0, 3.5.0, 3.6.0, 3.7.0, 3.8.0, 3.8.1, 3.9.0, 3.10.0, 3.11.0, 3.11.1, 3.12.0, 3.13.0, 3.14.0, 3.14.1, 3.15.0, 3.16.0, 3.16.1, 3.17.0, 3.18.0, 3.19.0, 3.20.0, 3.20.1, 3.22.0, 3.22.1, 3.23.0, 3.23.1, 3.24.0, 3.25.0, 3.25.1, 3.26.0, 3.26.1, 3.26.2, 3.26.3, 3.27.0, 3.29.0, 3.30.0, 3.31.0, 3.31.1, 3.32.0, 3.32.1, 3.32.2, 3.33.0, 3.33.1, 3.34.0, 3.35.0, 3.36.0, 3.37.0, 3.37.1, 3.37.2, 3.38.0, 3.39.0, 3.40.0, 3.40.1, 3.40.2, 3.40.3, 3.41.0, 3.41.1, 3.41.2, 3.42.0, 3.44.0, 3.44.1, 3.45.0, 3.46.0, 3.47.0, 3.48.0, 3.49.0, 3.50.0, 3.50.1, 3.50.2, 3.51.0, 3.52.0, 3.52.1, 3.52.2, 3.52.3, 3.52.4, 3.52.5, 3.52.6, 3.53.0, 3.54.0, 3.55.0, 3.56.0, 3.57.0, 3.57.1, 3.57.2
All unaffected versions: 3.57.3, 3.57.4, 3.57.5, 3.57.6, 3.57.7, 3.57.8, 3.58.0, 3.58.1, 3.58.2, 3.59.0, 3.60.0, 3.60.1, 3.60.2, 3.61.0, 4.0.0, 4.0.1, 4.0.2