CVE-2020-9708
GHSL-2020-133: Insufficient validation of user input in resolveRepositoryPath function
- State
- Published
- Severity
- 5.9 Medium
- Published
- Aug 14, 2020
- Updated
- Sep 16, 2024
- Reserved
- Mar 2, 2020
Description
The resolveRepositoryPath function doesn't properly validate user input and a malicious user may traverse to any valid Git repository outside the repoRoot. This issue may lead to unauthorized access of private Git repositories as long as the malicious user knows or brute-forces the location of the repository.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.9 Medium | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N | adobe |
Weaknesses
- CWE-24 Path Traversal: '../filedir'
Affected Products
| Product | Versions |
|---|---|
HelixAdobe |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.