Information Exposure Affecting @theia/mini-browser package, versions >=0.3.9 <0.16.0
Threat Intelligence
EPSS
0.26% (66th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-THEIAMINIBROWSER-1245507
- published 14 Apr 2021
- disclosed 13 Apr 2021
- credit Unknown
How to fix?
Upgrade @theia/mini-browser to version 0.16.0 or higher.
Overview
@theia/mini-browser is a Theia - Mini-Browser Extension
Affected versions of this package are vulnerable to Information Exposure. This extension exposes a HTTP endpoint that allows to read the content of files on the hosts filesystem, given their path, without restrictions on the requester's origin. This design is vulnerable to being exploited remotely through a DNS rebinding attack or a drive-by download of a carefully crafted exploit.
References
CVSS Scores
version 3.1