CVE-2020-7762: Path Traversal in jsreport-chrome-pdf
Summary
CVE-2020-7762: Path Traversal in jsreport-chrome-pdf. Affects jsreport-chrome-pdf versions < 1.10.0. Fixed in 1.10.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jsreport-chrome-pdf package is an npm package used for generating PDF reports using the Chrome browser. It provides a convenient way to convert HTML documents to PDF format. This vulnerability affects versions of jsreport-chrome-pdf prior to 1.10.0.
Vulnerability Detail
The vulnerability identified as CVE-2020-7762 is a Path Traversal vulnerability in jsreport-chrome-pdf. This vulnerability allows an attacker to access files outside of the intended directory by manipulating file paths. An attacker can exploit this vulnerability to read sensitive files or execute arbitrary code on the server. The severity of this vulnerability is rated as MODERATE with a CVSS score of 6.5.
How To Fix
Minimum fixed version
1.10.0
This is the first release that contains the fix.
npm install jsreport-chrome-pdf@1.10.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the jsreport-chrome-pdf package to the fixed version to mitigate the risk.
Conclusion
The Path Traversal vulnerability in jsreport-chrome-pdf can be mitigated by updating the package to version 1.10.0 or later. It is crucial to apply this fix to ensure the security of the application. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for jsreport-chrome-pdf →
FAQ
jsreport-chrome-pdf is an npm package used for generating PDF reports using the Chrome browser. It converts HTML documents to PDF format.
A Path Traversal vulnerability allows an attacker to access files outside of the intended directory by manipulating file paths.
This vulnerability can be exploited by an attacker to read sensitive files or execute arbitrary code on the server.
The severity of this vulnerability is rated as MODERATE with a CVSS score of 6.5.
To fix this vulnerability, update the jsreport-chrome-pdf package to version 1.10.0 or later.
