auri is a framework for building binaries for all major desktop platforms. The filesystem glob pattern wildcards `*`, `?`, and `[...]` match file path literals and leading dots by default, which unintentionally exposes sub folder content of allowed paths. Scopes without the wildcards are not affected. As `**` allows for sub directories the behavior there is also as expected. The issue has been patched in the latest release and was backported into the currently supported 1.x branches. There are no known workarounds at the time of publication.
| Link | Resource |
|---|---|
| https://github.com/tauri-apps/tauri/commit/72389b00d7b495ffd7750eb1e75a3b8537d07cf3 | Patch Third Party Advisory |
| https://github.com/tauri-apps/tauri/commit/f0602e7c294245ab6ef6fbf2a976ef398340ef58 | Patch Third Party Advisory |
| https://github.com/tauri-apps/tauri/security/advisories/GHSA-6mv3-wm7j-h4w5 | Exploit Third Party Advisory |
| https://github.com/tauri-apps/tauri/commit/72389b00d7b495ffd7750eb1e75a3b8537d07cf3 | Patch Third Party Advisory |
| https://github.com/tauri-apps/tauri/commit/f0602e7c294245ab6ef6fbf2a976ef398340ef58 | Patch Third Party Advisory |
| https://github.com/tauri-apps/tauri/security/advisories/GHSA-6mv3-wm7j-h4w5 | Exploit Third Party Advisory |
Configuration 1 (hide)
|
21 Nov 2024, 07:30
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.8 |
| References | () https://github.com/tauri-apps/tauri/commit/72389b00d7b495ffd7750eb1e75a3b8537d07cf3 - Patch, Third Party Advisory | |
| References | () https://github.com/tauri-apps/tauri/commit/f0602e7c294245ab6ef6fbf2a976ef398340ef58 - Patch, Third Party Advisory | |
| References | () https://github.com/tauri-apps/tauri/security/advisories/GHSA-6mv3-wm7j-h4w5 - Exploit, Third Party Advisory |
Published : 2022-12-23 14:15
Updated : 2024-11-21 07:30
NVD link : CVE-2022-46171
Mitre link : CVE-2022-46171
CVE.ORG link : CVE-2022-46171
JSON object : View
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')