Showing 4 vulnerabilities on this page for appwrite/server-ce

Signals CISA KEV Ransomware Nuclei
Packagist vulnerability results
VulnerabilityTitle and contextCVSSEPSSPoCsSignalsSTIX action

Appwrite Directory Traversal vulnerability

The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary local files via ../ directory traversal. In order to be vulnerable, APP_STORAGE_CERTIFICATES/.well-known/acme-challenge must exist on disk. (This pathname is automatically created if the user chooses to install Let's Encrypt certificates via Appwrite.)

CWE-22Feb 22, 2024
CVSS-v4.0EPSS0.793%PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

Appwrite Server-Side Request Forgery vulnerability

Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /v1/avatars/favicon. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request.

CWE-918Mar 31, 20231 related artifact
CVSS7.5v3.1EPSS36.2%PoCs0SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei templateSTIX

Cross-site Scripting (XSS) - Stored in appwrite/appwrite

Cross-site Scripting (XSS) - Stored in GitHub repository appwrite/appwrite prior to 1.0.0-RC1.

CWE-79Sep 9, 2022
CVSS5.4v3.1EPSS0.688%PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

Prototype Pollution

This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. When parsing the query string in the getJsonFromUrl function, the key that is set in the result object is not properly sanitized leading to a Prototype Pollution vulnerability.

CWE-1321Feb 16, 2022
CVSS7.3v3.1EPSS2.12%PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX