Vulnerabilities

TI-2022-09061 CVE-2022-25377 · GHSA-wfm3-gq9h-mrjm

The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote…

HIGH 72

The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary local files via ../ directory traversal.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00793 Published 2024-02-22 Fixed in 0.12.2 CWE-22

TI-2024-00984 CVE-2024-1063 · GHSA-vrjf-gppf-qvj4

Server-side request forgery in Appwrite

LOW 39

Appwrite <= v1.4.13 is affected by a Server-Side Request Forgery (SSRF) via the '/v1/avatars/favicon' endpoint due to an incomplete fix of CVE-2023-27159.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00445 Published 2024-01-30 No fix listed CWE-918

TI-2023-11948 CVE-2023-27159 · GHSA-hxgx-584x-vwm8

Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via…

HIGH 72

Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /v1/avatars/favicon.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.36419 Published 2023-03-31 No fix listed CWE-918

TI-2022-02705 CVE-2022-2925 · GHSA-5ffj-mph5-c5hv

Cross-site Scripting (XSS) - Stored in appwrite/appwrite

LOW 26

Cross-site Scripting (XSS) - Stored in GitHub repository appwrite/appwrite prior to 1.0.0-RC1.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00847 Published 2022-09-09 Fixed in 1.0.0-RC1 CWE-79

TI-2021-06180 CVE-2021-23682 · GHSA-v9p9-535w-4285

Prototype pollution in litespeed.js

MEDIUM 46

This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02117 Published 2022-02-16 Fixed in 0.3.12, 0.12.2 +1 CWE-1321