PT-2018-4157 · Inert · Inert

Publicado 2018-05-29 · Atualizado 2020-08-31 · CVE-2014-10068

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions inert versions prior to 1.1.1

Description The issue concerns an information leakage problem where files in hidden directories are served even when showHidden is set to false. This is due to the inert directory handler always allowing access to these files, regardless of the showHidden setting.

Recommendations Update to version 1.1.1 or later to resolve the issue. As a temporary workaround, consider restricting access to hidden directories until the update is applied.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2014-10068

GHSA-G4XP-36C3-F7MR

Produtos afetados

Inert

Referências · 6

• https://github.com/hapijs/inert/commit/e8f99f94da4cb08e8032eda984761c3f111e3e82 · Correção
• https://github.com/hapijs/inert/pull/15 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2014-10068 · Nota de Segurança
• https://nodesecurity.io/advisories/14 · Correção
• https://osv.dev/vulnerability/GHSA-g4xp-36c3-f7mr · Aviso do Fabricante
• https://npmjs.com/advisories/14 · Nota