Path Traversal in Stripe Stripe-Cli
CVE-2024-45401
stripe-cli is a command-line tool for the payment processor Stripe. A vulnerability exists in stripe-cli starting in version 1.11.1 and prior to version 1.21.3 where a plugin package containing a manifest with a malformed plugin shortname installed using the --archive-url or --archive-path flags can overwrite arbitrary files. The update in version 1.21.3 addresses the path traversal vulnerability by removing the ability to install plugins from an archive URL or path. There has been no evidence of exploitation of this vulnerability.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.002 (9.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H.
Affected products
- Stripe Stripe-cli — versions >= 1.11.1, < 1.21.3
- Stripe Stripe_cli
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2024-45401?
- CVE-2024-45401 is a high-severity vulnerability in Stripe Stripe-Cli, classified under Path Traversal. CVSS score: 7.5/10. Published 2024-09-05.
- How severe is CVE-2024-45401?
- High severity. CVSS v3 base score is 7.5 out of 10.