Reported

May 27, 2021

Issued

September 9, 2021 (last modified: September 10, 2021)

Package

pleaser (crates.io)

Type

Vulnerability

Categories

• file-disclosure

Aliases

• CVE-2021-31153
• GHSA-f3fg-5j9p-vchc

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-31153

CVSS Score

3.3 LOW

CVSS Details

Attack vector

Local

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Patched

• >=0.4

Description

pleaser before 0.4 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locations via the search_path function, the --check option, or the -d option.

Advisory available under CC0-1.0 license.