CVE-2019-5484: Path Traversal

September 13, 2019 (updated October 9, 2019)

Bower has a path traversal vulnerability permitting file write in arbitrary locations via install command, which allows attackers to write arbitrary files when a malicious package is extracted.

References

github.com/bower/bower/commit/45c6bfa86f6e57731b153baca9e0b41a1cc699e3
hackerone.com/reports/473811
nvd.nist.gov/vuln/detail/CVE-2019-5484

Code Behaviors & Features

Detect and mitigate CVE-2019-5484 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →