PT-2018-19175 · Node.Js · Superstatic+1

Publicado 2018-07-27 · Atualizado 2018-07-27

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions superstatic versions prior to 5.0.2

Description The issue affects superstatic, making it vulnerable to path traversal on Windows. Additionally, on other platforms, it is vulnerable to path traversal when combined with certain Node.js versions, such as Node.js v9.9.0, which incorrectly normalize `` to / in paths.

Recommendations Update to version 5.0.2 or later.

Enumeração de Fraquezas

CWE-177

Identificadores relacionados

GHSA-WM77-Q74P-5763

Produtos afetados

Node.Js

Superstatic

Referências · 5

• https://github.com/firebase/superstatic/blob/v5.0.1/lib/providers/fs.js#L71 · Nota
• https://github.com/firebase/superstatic/pull/255 · Nota
• https://github.com/firebase/superstatic/commit/e396ff62f588732989137d6c40d46b310e51ef2b · Nota
• https://osv.dev/vulnerability/GHSA-wm77-q74p-5763 · Aviso do Fabricante
• https://npmjs.com/advisories/652 · Nota