Vulnerability · Published Mar 30, 2020 · Assigned by GitHub_M

CVE-2020-5284Directory Traversal in Next.js versions below 9.3.2

Medium 4.4

In plain English

A medium-severity security flaw in next.js from zeit. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 44.8% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.4Medium

Exploit odds (30 days)44.8%top 1.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Nuclei

Official description

Next.js versions before 9.3.2 have a directory traversal vulnerability. Attackers could craft special requests to access files in the dist directory (.next). This does not affect files outside of the dist directory (.next). In general, the dist directory only holds build assets unless your application intentionally stores other assets under this directory. This issue is fixed in version 9.3.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	next	9.3.2	GHSA-fq77-7p7r-83rj

Affected products (as reported)

Vendor	Product	Versions
zeit	next.js	< 9.3.2

Weakness: CWE-23 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/zeit/next.js/security/advisories/GHSA-fq77-7p7r-83rj x_refsource_CONFIRM
https://github.com/zeit/next.js/releases/tag/v9.3.2 x_refsource_MISC