CVE-2021-32662
lowPriorität · verfolgen · 26EPSS 0.013 · 70. PerzentilEUUSEPSS · bewertet 2026-10-27
Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In `@backstage/techdocs-common` versions prior to 0.6.3, a malicious actor could read sensitive files from the environment where TechDocs documentation is built and published by setting a particular path for `docs_dir` in `mkdocs.yml`. These files would then be available over the TechDocs backend API. This vulnerability is mitigated by the fact that an attacker would need access to modify the `mkdocs.yml` in the documentation source code, and would also need access to the TechDocs backend API. The vulnerability is patched in the `0.6.3` release of `@backstage/techdocs-common`.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–medium · 3.5–6.5
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (3)
Betroffene Produkte und Versionsbereiche.
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- GHSA-pgf8-28gg-vpr6Path traversal2021-06-04ghsa · osvUS
### Impact A malicious actor could read sensitive files from the environment where TechDocs documentation is built and published by setting a particular path for `docs_dir` in `mkdocs.yml`. These files would then be available over the TechDocs backend API. This vulnerability is mitigated by the fact that an attacker would need access to modify the `mkdocs.yml` in the documentation source code, and would also need access to the TechDocs backend API. ### Patches The vulnerability is patched in the `0.6.3` release of `@backstage/techdocs-common`. ### For more information If you have any questions or comments about this advisory: * Open an issue in the [Backstage repository](https://github.com/backstage/backstage) * Visit our chat, linked to in [Backstage README](https://github.com/backstage/backstage)
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (10)
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/backstage/backstage/commit/8cefadca04cbf01d0394b0cb1983247e5f1d6208cnnvd
- https://github.com/backstage/backstage/releases/tag/release-2021-05-27cnnvd
- https://github.com/backstage/backstage/security/advisories/GHSA-pgf8-28gg-vpr6cnnvd
- https://www.cybersecurity-help.cz/vdb/SB2021060703cnnvd
- https://github.com/backstage/backstage/commit/8cefadca04cbf01d0394b0cb1983247e5f1d6208enisa_euvd
- https://github.com/backstage/backstage/releases/tag/release-2021-05-27enisa_euvd
- https://github.com/backstage/backstage/security/advisories/GHSA-pgf8-28gg-vpr6enisa_euvd
- https://github.com/backstage/backstage/commit/8cefadca04cbf01d0394b0cb1983247e5f1d6208PatchThird Party Advisorynvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan