{ "data_type": "CVE", "data_format": "MITRE", "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2019-5484", "ASSIGNER": "support@hackerone.com", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "vendor_name": "n/a", "product": { "product_data": [ { "product_name": "bower", "version": { "version_data": [ { "version_value": "Fixed in >=1.8.8" } ] } } ] } } ] } }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "Path Traversal (CWE-22)" } ] } ] }, "references": { "reference_data": [ { "refsource": "MISC", "name": "https://hackerone.com/reports/473811", "url": "https://hackerone.com/reports/473811" }, { "refsource": "MISC", "name": "https://snyk.io/blog/severe-security-vulnerability-in-bowers-zip-archive-extraction", "url": "https://snyk.io/blog/severe-security-vulnerability-in-bowers-zip-archive-extraction" }, { "refsource": "MISC", "name": "https://github.com/bower/bower/commit/45c6bfa86f6e57731b153baca9e0b41a1cc699e3", "url": "https://github.com/bower/bower/commit/45c6bfa86f6e57731b153baca9e0b41a1cc699e3" }, { "refsource": "MLIST", "name": "[netbeans-commits] 20200429 [jira] [Created] (NETBEANS-4280) cleanup potential security breaches", "url": "https://lists.apache.org/thread.html/r8ba4c628fba7181af58817d452119481adce4ba92e889c643e4c7dd3@%3Ccommits.netbeans.apache.org%3E" }, { "refsource": "MLIST", "name": "[netbeans-notifications] 20200429 [GitHub] [netbeans] BradWalker opened a new pull request #2110: [NETBEANS-4280] - cleanup potential security breaches", "url": "https://lists.apache.org/thread.html/rb5ac16fad337d1f3bb7079549f97d8166d0ef3082629417c39f12d63@%3Cnotifications.netbeans.apache.org%3E" } ] }, "description": { "description_data": [ { "lang": "eng", "value": "Bower before 1.8.8 has a path traversal vulnerability permitting file write in arbitrary locations via install command, which allows attackers to write arbitrary files when a malicious package is extracted." } ] } }