PT-2018-16137 · Node.Js · Angular-Http-Server

Bl4De + 1 · Published 2018-06-07 · Updated 2023-02-28 · CVE-2018-3713

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions angular-http-server versions prior to 1.6.0

Description The angular-http-server node module has a Path Traversal issue due to the lack of validation of the possibleFilename variable, allowing a malicious user to read the content of any file with a known path. This enables a remote attacker to read files from the server that uses angular-http-server.

Recommendations Update to version 1.6.0 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2018-3713

GHSA-4RVG-955W-H68Q

Affected Products

Angular-Http-Server

References · 8

• 🔥 https://hackerone.com/reports/309120 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-3713 · Security Note
• https://osv.dev/vulnerability/GHSA-4rvg-955w-h68q · Vendor Advisory
• https://github.com/simonh1000/angular-http-server/pull/21 · Note
• https://github.com/simonh1000/angular-http-server/commit/34d4bd0cd0f00c46db30855a8c4aabae27eb0ac8 · Note
• https://github.com/advisories/GHSA-4rvg-955w-h68q · Note
• https://npmjs.com/advisories/589 · Note
• https://t.me/cvenotify/45170 · Telegram Post