CVE-2020-7790 MEDIUM

CVE-2020-7790: Arbitrary File Read

Vendor N/A
Product spatie/browsershot
Published December 11, 2020
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

This affects the package spatie/browsershot from 0.0.0. By specifying a URL in the file:// protocol an attacker is able to include arbitrary files in the resultant PDF.

Key dates

02Disclosure timeline

December 11, 2020 CVE published
September 16, 2024 Record updated