PsiTransfer: File integrity violation

Description

The absence of restrictions on the endpoint, which is designed for uploading files, allows an attacker who received the id of a file distribution to change the files that are in this distribution.

Recommendation

Update the psitransfer package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.2.0
• Patched version(s): 2.2.0

References

• GHSA-2p2x-p7wj-j5h2
• CVE-2024-31454
• CWE-434
• CAPEC-310
• OWASP 2021-A4
• OWASP 2021-A6

Related Issues

• PsiTransfer: Violation of the integrity of file distribution - CVE-2024-31453
• VvvebJs Arbitrary File Upload vulnerability - CVE-2024-29272
• webcrack has an Arbitrary File Write Vulnerability on Windows when Parsing and Saving a Malicious Bundle - CVE-2024-43373
• jsPDF Vulnerable to Stored XMP Metadata Injection (Spoofing & Integrity Violation) - CVE-2026-24043

Tags:

npm

psitransfer