CVE-2023-35844: Path Traversal
packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow .. directory traversal and do not ensure that an intended file extension (.csv or .png) is used.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-35844?
CVE-2023-35844 is classified as a medium severity vulnerability due to its potential for allowing unauthorized access to sensitive files.
How do I fix CVE-2023-35844?
To fix CVE-2023-35844, upgrade Lightdash to version 0.510.3 or later, which addresses the insecure file endpoints.
What kind of attacks can CVE-2023-35844 allow?
CVE-2023-35844 can allow directory traversal attacks, potentially enabling an attacker to access files outside the intended directory.
Which versions of Lightdash are affected by CVE-2023-35844?
Versions of Lightdash prior to 0.510.3 are affected by CVE-2023-35844.
What are the insecure features in CVE-2023-35844?
CVE-2023-35844 features insecure file endpoints that do not validate file extensions, such as .csv or .png, allowing for exploitation.