CVE-2020-5284

medium · 4.4

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

Next.js versions before 9.3.2 have a directory traversal vulnerability. Attackers could craft special requests to access files in the dist directory (.next). This does not affect files outside of the dist directory (.next). In general, the dist directory only holds build assets unless your application intentionally stores other assets under this directory. This issue is fixed in version 9.3.2.

4.4

CVSS

44.3%

EPSS (exploit prob.)

99th

EPSS percentile

2020-03-30

Published

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

Weaknesses

CWE-23CWE-22

Affected products

Vendor	Product	Affected versions
zeit	next.js	< 9.3.2

Check a specific version with /api/v1/cve/match.

References

https://github.com/zeit/next.js/releases/tag/v9.3.2
https://github.com/zeit/next.js/security/advisories/GHSA-fq77-7p7r-83rj
https://github.com/zeit/next.js/releases/tag/v9.3.2
https://github.com/zeit/next.js/security/advisories/GHSA-fq77-7p7r-83rj

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2020-5284