PT-2019-20044 · Unknown · Serve-Here.Js

Publicado 2019-07-05 · Atualizado 2019-07-05

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions serve-here.js versions prior to 1.2.0

Description The issue arises from the package's failure to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths. This can be exploited through Path Traversal attacks.

Recommendations For versions prior to 1.2.0, upgrade to version 1.2.0 or later.

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

GHSA-G8M7-QHV7-9H5X

Produtos afetados

Serve-Here.Js

Referências · 6

• https://github.com/vivaxy/here/commit/298dbab41344dfb7f95f66b1fa7b5cfb436bd4a2 · Nota
• https://github.com/vivaxy/here/pull/17 · Nota
• https://npmjs.com/advisories/554 · Nota
• https://hackerone.com/reports/296254 · Nota
• https://osv.dev/vulnerability/GHSA-g8m7-qhv7-9h5x · Aviso do Fabricante
• https://hackerone.com/reports/569966 · Nota