Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Dragonfly allows arbitrary file read and write on a peer machine
Vulnerability Description
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the gRPC API and HTTP APIs allow peers to send requests that force the recipient peer to create files in arbitrary file system locations, and to read arbitrary files. This allows peers to steal other peers’ secret data and to gain remote code execution (RCE) capabilities on the peer’s machine.This vulnerability is fixed in 2.1.0.
CVSS Information
N/A
Vulnerability Type
通过数据查询的敏感数据暴露
Vulnerability Title
Dragonfly 安全漏洞
Vulnerability Description
Dragonfly是DragonflyDB开源的一个框架，可以对任何内容类型进行动态处理。 Dragonfly 2.1.0之前版本存在安全漏洞，该漏洞源于gRPC API和HTTP API允许对等节点发送请求强制接收节点在任意文件系统位置创建文件和读取任意文件，可能导致窃取其他对等节点的秘密数据和在目标机器上执行远程代码。
CVSS Information
N/A
Vulnerability Type
N/A