PT-2019-14304 · Unknown · Http Server

Vineet Pandey + 1 · Publicado 2019-12-18 · Atualizado 2020-03-31 · CVE-2019-15600

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions http server versions all

Description A path traversal issue exists, allowing an attacker to read arbitrary system files. Additionally, all versions of http server are vulnerable to Cross-Site Scripting (XSS) due to the failure to sanitize filenames, enabling attackers to execute arbitrary JavaScript in the victim's browser through files with malicious code in their names.

Recommendations For all versions, consider using an alternative package until a fix is made available. As a temporary workaround, consider restricting access to sensitive system files and avoiding the use of filenames that could contain malicious code.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2019-15600

GHSA-754X-4JWP-CQP6

Produtos afetados

Http Server

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-15600 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-15600 · Aviso do Fabricante
• https://npmjs.com/advisories/1170 · Nota
• https://hackerone.com/reports/692262 · Nota
• https://hackerone.com/reports/578138 · Nota
• https://osv.dev/vulnerability/GHSA-754x-4jwp-cqp6 · Aviso do Fabricante