PT-2017-13726 · Node.Js+1 · Node.Js+1

Michael Dawson · Published 2017-09-28 · Updated 2020-01-17 · CVE-2017-14849

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Node.js versions 8.5.0

Description The issue allows remote attackers to access unintended files due to a change in ".." handling that is incompatible with the pathname validation used by community modules.

Recommendations For Node.js version 8.5.0, update to version 8.6.0 or later to resolve the issue.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2017-14849

SUSE-SU-2019:14246-1

SUSE-SU-2019_14246-1

Affected Products

Node.Js

Suse

References · 489

• 🔥 https://github.com/tunz/js-vuln-db/blob/master/v8/CVE-2016-5172.md · Exploit
• 🔥 https://github.com/ssllabs/openssl-ccs-cve-2014-0224 · Exploit
• 🔥 https://github.com/secretnonempty/CVE-2014-0224 · Exploit
• 🔥❌ https://github.com/alidnf/CVE-2019-11730 · Exploit, Deleted
• https://bdu.fstec.ru/vul/2020-01411 · Security Note
• https://bdu.fstec.ru/vul/2020-01404 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2019:14246-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00598 · Security Note
• https://bdu.fstec.ru/vul/2022-05798 · Security Note
• https://bdu.fstec.ru/vul/2019-03615 · Security Note
• https://bdu.fstec.ru/vul/2022-02558 · Security Note
• https://bdu.fstec.ru/vul/2019-02996 · Security Note
• https://bdu.fstec.ru/vul/2015-07482 · Security Note
• https://bdu.fstec.ru/vul/2019-00186 · Security Note
• https://bdu.fstec.ru/vul/2019-02933 · Security Note