PT-2019-20037 · Algo · Algo-Httpserv

Publicado 2019-09-11 · Atualizado 2019-09-11

Positive Technologies (AI Summary)

CVSS v3.1

8.6

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions algo-httpserv versions prior to 1.1.2

Description The issue is due to insufficient input sanitization, allowing attackers to access server files by using relative paths. This can lead to a Path Traversal attack.

Recommendations Upgrade to version 1.1.2 or later.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

GHSA-CGJV-RGHQ-QHGP

Produtos afetados

Algo-Httpserv

Referências · 4

• https://github.com/AlgoRythm-Dylan/httpserv/commit/bcfe9d4316c2b59aab3a64a38905376026888735 · Nota
• https://snyk.io/vuln/SNYK-JS-ALGOHTTPSERV-174741 · Nota
• https://osv.dev/vulnerability/GHSA-cgjv-rghq-qhgp · Aviso do Fabricante
• https://npmjs.com/advisories/889 · Nota