CVE-2022-25937 MEDIUM

CVE-2022-25937

Vendor N/A
Product glance
Weakness CWE-22 · Path traversal
Published February 13, 2023
Last update March 21, 2025
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P

What the vulnerability does

01Description

Versions of the package glance before 3.0.9 are vulnerable to Directory Traversal that allows users to read files outside the public root directory. This is related to but distinct from the vulnerability reported in [CVE-2018-3715](https://security.snyk.io/vuln/npm:glance:20180129).

Key dates

02Disclosure timeline

February 13, 2023 CVE published
March 21, 2025 Record updated