Vulnerability · Published Aug 3, 2023 · Assigned by cloudflare
CVE-2023-3348Directory traversal vulnerability in Cloudflare Wrangler
Medium 5.7
In plain English
A medium-severity path traversal in Wrangler from Cloudflare. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The Wrangler command line tool (<=wrangler@3.1.0 or <=wrangler@2.20.1) was affected by a directory traversal vulnerability when running a local development server for Pages (wrangler pages dev command). This vulnerability enabled an attacker in the same network as the victim to connect to the local development server and access the victim's files present outside of the directory for the development server.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | wrangler | 2.20.1 | GHSA-8c93-4hch-xgxp |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cloudflare | Wrangler | 3 – before 3.1.12 – before 2.20.1 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N