Path to dependency file: /jupyter-scipy/requirements.txt
Path to vulnerable library: /jupyter-scipy/requirements.txt,/jupyter-pytorch-full/requirements.txt,/jupyter-scipy/requirements.txt,/jupyter-tensorflow-full/requirements.txt,/jupyter-pytorch-full/requirements.txt,/jupyter-tensorflow-full/requirements.txt
Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web service which was built using Starlette.
CVE-2023-29159 - High Severity Vulnerability
The little ASGI library that shines.
Library home page: https://files.pythonhosted.org/packages/12/48/f9c1ec6bee313aba264fbc2483d9070f4e4526f2538e2b55b1e4a391d938/starlette-0.26.1-py3-none-any.whl
Path to dependency file: /jupyter-scipy/requirements.txt
Path to vulnerable library: /jupyter-scipy/requirements.txt,/jupyter-pytorch-full/requirements.txt,/jupyter-scipy/requirements.txt,/jupyter-tensorflow-full/requirements.txt,/jupyter-pytorch-full/requirements.txt,/jupyter-tensorflow-full/requirements.txt
Dependency Hierarchy: - :x: **starlette-0.26.1-py3-none-any.whl** (Vulnerable Library)
Found in HEAD commit: 513157c5d3f5743d53e228da1ec8289e92c92836
Found in base branch: master
Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web service which was built using Starlette.
Publish Date: 2023-06-01
URL: CVE-2023-29159
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://github.com/encode/starlette/security/advisories/GHSA-v5gw-mw7f-84px
Release Date: 2023-06-01
Fix Resolution: 0.28.0
Step up your Open Source Security Game with Mend here