PT-2018-2890 · Apache · Apache Thrift Node.Js
Publicado
2018-10-05
·
Atualizado
2026-05-18
·
CVE-2018-11798
CVSS v2.0
6.8
Média
| Vetor | AV:N/AC:L/Au:S/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Apache Thrift Node.js versions 0.9.2 through 0.11.0
Description
The issue allows a remote user to access files outside the set web server's docroot path due to a security vulnerability in the Apache Thrift Node.js static web server. This vulnerability is related to the lack of protection for service data and can be exploited by a remote attacker to gain unauthorized access to protected information. The vulnerability exists because of incorrect restriction of the path name to a directory with limited access, allowing an attacker to access arbitrary files.
Recommendations
For versions 0.9.2 through 0.11.0, consider restricting access to sensitive files and directories until a patch is available. As a temporary workaround, limit the web server's access to only necessary files and directories to minimize the risk of exploitation.
Correção
Improper Access Control
Path traversal
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Apache Thrift Node.Js