PT-2019-17652 · Unknown · Localhost-Now

Publicado 2019-03-17 · Atualizado 2019-10-09 · CVE-2019-5416

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions localhost-now version 1.0.2 localhost-now versions prior to a fixed version (no fixed version specified)

Description A path traversal issue allows attackers to read the content of arbitrary files on the remote server. The package fails to sanitize URLs, enabling attackers to access server files outside of the served folder using relative paths.

Recommendations For version 1.0.2, consider using an alternative package until a fix is made available. For versions prior to a fixed version, consider using an alternative package until a fix is made available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2019-5416

GHSA-QWJ8-P662-3M7X

Produtos afetados

Localhost-Now

Referências · 6

• 🔥 https://hackerone.com/reports/334837 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-5416 · Nota de Segurança
• https://github.com/advisories/GHSA-qwj8-p662-3m7x · Nota
• https://npmjs.com/advisories/1005 · Nota
• https://osv.dev/vulnerability/GHSA-qwj8-p662-3m7x · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-5416 · Aviso do Fabricante