PT-2019-17651 · Serve · Serve

Publicado 2019-03-17 · Atualizado 2020-10-19 · CVE-2019-5415

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions serve versions prior to 7.0.1

Description A bug in handling the ignore files and directories feature in serve allows an attacker to read a file or list the directory that the victim has not allowed access to. This issue is related to Path Traversal, where explicitly ignored folders can be accessed if the path contains a /./, allowing attackers to access hidden folders and files.

Recommendations For versions prior to 7.0.1, upgrade to version 7.0.1 or later.

Exploit

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

CWE-548

Identificadores relacionados

CVE-2019-5415

GHSA-V588-QCP3-JV46

Produtos afetados

Serve

Referências · 6

• 🔥 https://hackerone.com/reports/330724 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-5415 · Nota de Segurança
• https://npmjs.com/advisories/1010 · Nota
• https://github.com/advisories/GHSA-v588-qcp3-jv46 · Nota
• https://osv.dev/vulnerability/CVE-2019-5415 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-v588-qcp3-jv46 · Aviso do Fabricante