{"id":"CVE-2022-0436","published":"2022-04-12T00:00:00Z","modified":"2024-08-02T23:25:40Z","title":"Path Traversal in gruntjs/grunt","vendor":"gruntjs","product":"gruntjs/grunt","tier":"tail","description":{"text":"Path Traversal in GitHub repository gruntjs/grunt prior to 1.5.2.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.1,"severity":"HIGH","version":"3.0","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00589,"percentile":0.48068,"provenance":"source"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://huntr.dev/bounties/f55315e9-9f6d-4dbb-8c40-bae50c1ae92b","tags":[]},{"url":"https://github.com/gruntjs/grunt/commit/aad3d4521c3098fb255fb2db8f2e1d691a033665","tags":[]},{"url":"https://lists.debian.org/debian-lts-announce/2023/04/msg00008.html","tags":["mailing-list"]}],"priority":{"score":14.6,"factors":[{"name":"EPSS percentile","points":9.61},{"name":"CVSS severity","points":4.97}]},"vendorSlug":"gruntjs","affectedVersions":[{"vendor":"gruntjs","product":"gruntjs/grunt","versions":[">= unspecified, < 1.5.2"]}],"affected":[{"ecosystem":"npm","package":"grunt","vulnerableRanges":["<1.5.2"],"patched":["1.5.2"],"from":["GHSA-j383-35pm-c5h4"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-1767","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-gruntjs-grunt-cve-2020-7729","parents":[{"from":"CVE-2020-7729","to":"CVE-2022-0436","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"npm:grunt","fromFixed":"1.3.0","toFixed":"1.5.2","daysApart":586},{"kind":"same-code","provenance":"machine","files":["lib/grunt/file.js"],"commits":["https://github.com/gruntjs/grunt/commit/e350cea1724eb3476464561a380fb6a64e61e4e7","https://github.com/gruntjs/grunt/commit/aad3d4521c3098fb255fb2db8f2e1d691a033665","https://github.com/gruntjs/grunt/commit/b0ec6e12426fc8d5720dee1702f6a67455c5986c"],"basis":"rarely changed file"}]}],"children":[{"from":"CVE-2022-0436","to":"CVE-2022-1537","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"npm:grunt","fromFixed":"1.5.2","toFixed":"1.5.3","daysApart":28},{"kind":"same-code","provenance":"machine","files":["lib/grunt/file.js"],"commits":["https://github.com/gruntjs/grunt/commit/aad3d4521c3098fb255fb2db8f2e1d691a033665","https://github.com/gruntjs/grunt/commit/b0ec6e12426fc8d5720dee1702f6a67455c5986c","https://github.com/gruntjs/grunt/commit/58016ffac5ed9338b63ecc2a63710f5027362bae"],"basis":"rarely changed file"},{"kind":"similar","provenance":"machine","score":0.66,"basis":"same product + description similarity"}]}],"packageHistory":[{"cve":"CVE-2020-7729","published":"2020-09-03","fixed":"1.3.0","kev":false},{"cve":"CVE-2022-0436","published":"2022-04-12","fixed":"1.5.2","kev":false},{"cve":"CVE-2022-1537","published":"2022-05-10","fixed":"1.5.3","kev":false}],"package":"npm:grunt"}}