{
"id": "GHSA-7wgr-7666-7pwj",
"aliases": [
"CVE-2020-15141"
],
"details": "### Impact\nPath traversal vulnerability. If a user generated a client using a maliciously crafted OpenAPI document, it is possible for generated files to be placed in arbitrary locations on disk.\n\nGiving this a CVSS score of 3.0 (Low) with CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N/E:P/RL:U/RC:C\n\n### Patches\nA fix is being worked on for version 0.5.3\n\n### Workarounds\nInspect OpenAPI documents before generating clients for them.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [openapi-python-client](https://github.com/triaxtec/openapi-python-client/issues)\n* Email us at [[email protected] ](mailto:[email protected] )",
"summary": "Path Traversal in openapi-python-client",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.5.3"
}
]
}
],
"package": {
"name": "openapi-python-client",
"ecosystem": "PyPI"
}
}
],
"modified": "2024-10-07T16:46:45Z",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N"
}
],
"published": "2020-08-20T14:38:13Z",
"references": [
{
"url": "https://github.com/triaxtec/openapi-python-client/security/advisories/GHSA-7wgr-7666-7pwj",
"type": "WEB"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15141",
"type": "ADVISORY"
},
{
"url": "https://github.com/triaxtec/openapi-python-client/commit/3e7dfae5d0b3685abf1ede1bc6c086a116ac4746",
"type": "WEB"
},
{
"url": "https://github.com/openapi-generators/openapi-python-client",
"type": "PACKAGE"
},
{
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/openapi-python-client/PYSEC-2020-70.yaml",
"type": "WEB"
},
{
"url": "https://github.com/triaxtec/openapi-python-client/blob/main/CHANGELOG.md#053---2020-08-13",
"type": "WEB"
},
{
"url": "https://pypi.org/project/openapi-python-client",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"severity": "LOW",
"github_reviewed": true,
"nvd_published_at": null,
"github_reviewed_at": "2020-08-14T16:08:41Z"
}
}