PT-2018-16205 · Serve · Serve

Tungpun · Published 2018-06-01 · Updated 2018-07-18 · CVE-2018-3809

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions serve versions prior to 7.0.0

Description The issue allows information exposure through directory listings, enabling access to files even when they are set to be ignored. This occurs in versions of serve before 7.0.0, specifically bypassing the ignore security control on case-insensitive file systems.

Recommendations Update to version 7.0.0 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-3809

GHSA-686G-3XR3-X4X6

Affected Products

Serve

References · 6

• 🔥 https://hackerone.com/reports/330650 · Exploit
• https://osv.dev/vulnerability/CVE-2018-3809 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-3809 · Security Note
• https://osv.dev/vulnerability/GHSA-686g-3xr3-x4x6 · Vendor Advisory
• https://npmjs.com/advisories/672 · Note
• https://github.com/advisories/GHSA-686g-3xr3-x4x6 · Note