Next.js versions before 9.3.2 have a directory traversal vulnerability. Attackers could craft special requests to access files in the dist directory (.next). This does not affect files outside of the dist directory (.next). In general, the dist directory only holds build assets unless your application intentionally stores other assets under this directory. This issue is fixed in version 9.3.2.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Next.js versions before 9.3.2 have a directory traversal vulnerability. Attackers could craft special
    requests to access files in the dist directory (.next). This does not affect files outside of the dist
    directory (.next). In general, the dist directory only holds build assets unless your application
    intentionally stores other assets under this directory. This issue is fixed in version 9.3.2.
    (CVE-2020-5284)

Versions of the Next.js framework before version 9.3.2 suffer from a vulnerability allowing an attacker, via a specially forged request, to access arbitrary files in the folder ".next".

This vulnerability does not affect files outside the folder ".next".

In general, the ".next" directory only holds build assets.

This issue is fixed in version 9.3.2

ID	Name	Product	Family	Severity
423514	SCA: security update for next (GHSA-fq77-7p7r-83rj)	Tenable Cloud Security	SCA Checks	medium
423514	SCA: security update for next (GHSA-fq77-7p7r-83rj)	Tenable Self-Hosted Container Security	SCA Checks	medium
112716	Next.js < 9.3.2 Path Traversal	Web App Scanning	Component Vulnerability	medium

Detections

Analytics

CVE-2020-5284

medium

Tenable Plugins

medium

medium

medium