CVE-2020-5284 - CVE House
Back to Database
Status published Medium CVE-2020-5284

Directory Traversal in Next.js versions below 9.3.2

Vulnerability Description

Next.js versions before 9.3.2 have a directory traversal vulnerability. Attackers could craft special requests to access files in the dist directory (.next). This does not affect files outside of the dist directory (.next). In general, the dist directory only holds build assets unless your application intentionally stores other assets under this directory. This issue is fixed in version 9.3.2.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-5284

Credits & Attribution

No credits recorded in the NVD database.

References

More from zeit

View All →
CVE-2018-6184
ZEIT Next.js 4 before 4.2.3 has Directory Traversal under the...
High 7.5
CVE-2018-3809
Information exposure through directory listings in serve 6.5.3 allows directory...
Medium 5.3
CVE-2018-18282
Next.js 7.0.0 and 7.0.1 has XSS via the 404 or...
Medium 6.1
CVE-2017-16877
ZEIT Next.js before 2.4.1 has directory traversal under the /_next...
High 7.5

Affected Vendor

Affected Software

next.js
Vulnerable Versions:
< 9.3.2

Timeline

Official Publish: March 30th, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-23

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1105 Ingress Tool Transfer
Command and Control
T1565 Data Manipulation
Impact