Homepage
About Snyk

Improper Input Validation Affecting plug package, versions >=1.3.0 <1.3.2 >=1.2.0-rc.0 <1.2.3 >=1.1.0 <1.1.7 <1.0.4

0.0
high

Snyk CVSS

    Attack Complexity Low
    Confidentiality High
    Integrity High
    Availability High

    Threat Intelligence

    EPSS 0.04% (12th percentile)
Expand this section
NVD
7.8 high

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-HEX-PLUG-1088063
  • published 30 Mar 2021
  • disclosed 28 Feb 2017
  • credit Griffin Byatt, Chip Durland, Raviv Cohen, Matthew Diaz
Report a new vulnerability Found a mistake?

Introduced: 28 Feb 2017

CVE-2017-1000052 Open this link in a new tab
CWE-20 Open this link in a new tab
CWE-74 Open this link in a new tab

How to fix?

Upgrade plug to version 1.3.2, 1.2.3, 1.1.7, 1.0.4 or higher.

Overview

plug is a specification and conveniences for composable modules between web applications.

Affected versions of this package are vulnerable to Improper Input Validation. Plug.Static is used for serving static assets, and is vulnerable to null byte injection. If file upload functionality is provided, this can allow users to bypass filetype restrictions and upload arbitrary code.