What is GHSA-39v3-f278-vj3g?

GHSA-39v3-f278-vj3g is a security advisory published by GitHub Security Advisories with High severity. @backstage/plugin-techdocs-backend storage bucket Directory Traversal vulnerability

Which CVE IDs does GHSA-39v3-f278-vj3g cover?

GHSA-39v3-f278-vj3g covers the following CVE IDs: CVE-2024-45816. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-39v3-f278-vj3g?

GHSA-39v3-f278-vj3g has a CVSS v3 base score of 7.7, published by GitHub Security Advisories.

Which products are affected by GHSA-39v3-f278-vj3g?

GHSA-39v3-f278-vj3g affects 1 product, including: npm/@backstage/plugin-techdocs-backend:\u003c 1.10.13.

GHSA-39v3-f278-vj3gHighCVSS 7.7

@backstage/plugin-techdocs-backend storage bucket Directory Traversal vulnerability

Vendor

GitHub Security Advisories

Published

September 17, 2024

Last Modified

January 3, 2025

🔗 CVE IDs covered (1)

CVE-2024-45816 →

📋 Description

Impact

When using the AWS S3 or GCS storage provider for TechDocs it is possible to access content in the entire storage bucket. This can leak contents of the bucket that are not intended to be accessible, as well as bypass permission checks in Backstage.

Patches

This has been fixed in the 1.10.13 release of the @backstage/plugin-techdocs-backend package.

References

If you have any questions or comments about this advisory:

Open an issue in the Backstage repository Visit our Discord, linked to in Backstage README

🎯 Affected products1

npm/@backstage/plugin-techdocs-backend:< 1.10.13

🔗 References (3)

https://github.com/backstage/backstage/security/advisories/GHSA-39v3-f278-vj3g
https://nvd.nist.gov/vuln/detail/CVE-2024-45816
https://github.com/advisories/GHSA-39v3-f278-vj3g