CRITICAL9.1

GHSA-gfqf-9w98-7jmx

Stimulsoft Dashboard.JS directory traversal vulnerability

Quick fix

GHSA-gfqf-9w98-7jmx — stimulsoft-dashboards-js: upgrade to the fixed version with the command below.

npm install stimulsoft-dashboards-js@2024.1.3

Details

Directory Traversal vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.3 allows a remote attacker to execute arbitrary code via a crafted payload to the fileName parameter of the Save function.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/stimulsoft-dashboards-js

Introduced in: 0Fixed in: 2024.1.3

Fixnpm install stimulsoft-dashboards-js@2024.1.3

References

https://nvd.nist.gov/vuln/detail/CVE-2024-24398[ADVISORY]
https://cloud-trustit.spp.at/s/Pi78FFazHamJQ5R[WEB]
https://cves.at/posts/cve-2024-24398/writeup[WEB]
https://github.com/stimulsoft/Dashboards.JS[PACKAGE]
http://stimulsoft.com[WEB]