PT-2017-13726 · Node.Js+1 · Node.Js+1

Michael Dawson · Publicado 2017-09-28 · Atualizado 2020-01-17 · CVE-2017-14849

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Node.js versions 8.5.0

Description The issue allows remote attackers to access unintended files due to a change in ".." handling that is incompatible with the pathname validation used by community modules.

Recommendations For Node.js version 8.5.0, update to version 8.6.0 or later to resolve the issue.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2017-14849

SUSE-SU-2019:14246-1

SUSE-SU-2019_14246-1

Produtos afetados

Node.Js

Suse

Referências · 489

• 🔥 https://github.com/tunz/js-vuln-db/blob/master/v8/CVE-2016-5172.md · Exploit
• 🔥 https://github.com/ssllabs/openssl-ccs-cve-2014-0224 · Exploit
• 🔥 https://github.com/secretnonempty/CVE-2014-0224 · Exploit
• 🔥❌ https://github.com/alidnf/CVE-2019-11730 · Exploit, Deleted
• https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssl/openssl_ccs.rb · Nota
• https://github.com/libexpat/libexpat/issues/317 · Nota
• https://github.com/Tripwire/OpenSSL-CCS-Inject-Test · Nota
• https://suse.com/security/cve/CVE-2019-11763.html · Nota
• https://suse.com/security/cve/CVE-2019-11736 · Nota
• https://bugzilla.mozilla.org/show_bug.cgi?id=1548306 · Nota
• https://bdu.fstec.ru/vul/2020-01411 · Nota de Segurança
• https://bugzilla.suse.com/1087459 · Nota
• https://bugzilla.suse.com/1146094 · Nota
• https://bdu.fstec.ru/vul/2020-01404 · Nota de Segurança
• https://suse.com/security/cve/CVE-2019-11743.html · Nota