PT-2018-16137 · Node.Js · Angular-Http-Server

Bl4De + 1 · Publicado 2018-06-07 · Atualizado 2023-02-28 · CVE-2018-3713

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions angular-http-server versions prior to 1.6.0

Description The angular-http-server node module has a Path Traversal issue due to the lack of validation of the possibleFilename variable, allowing a malicious user to read the content of any file with a known path. This enables a remote attacker to read files from the server that uses angular-http-server.

Recommendations Update to version 1.6.0 or later.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2018-3713

GHSA-4RVG-955W-H68Q

Produtos afetados

Angular-Http-Server

Referências · 8

• 🔥 https://hackerone.com/reports/309120 · Exploit
• https://github.com/simonh1000/angular-http-server/pull/21 · Nota
• https://github.com/simonh1000/angular-http-server/commit/34d4bd0cd0f00c46db30855a8c4aabae27eb0ac8 · Nota
• https://github.com/advisories/GHSA-4rvg-955w-h68q · Nota
• https://npmjs.com/advisories/589 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-3713 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-4rvg-955w-h68q · Aviso do Fabricante
• https://t.me/cvenotify/45170 · Publicação no Telegram