Description
The absence of restrictions on the endpoint, which is designed for uploading files, allows an attacker who received the id of a file distribution to change the files that are in this distribution.
Recommendation
Update the psitransfer package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.2.0
- Patched version(s): 2.2.0
References
Related Issues
- Prototype Pollution in jquery-deparam - CVE-2021-20087
- files.photo.gallery command injection - CVE-2024-53615
- Potential XSS vulnerability in jQuery - CVE-2020-11023
- mapshaper Path Traversal vulnerability - CVE-2024-1163
- Tags:
- npm
- psitransfer
Anything's wrong? Let us know Last updated on April 09, 2024