PT-2019-14304 · Unknown · Http Server

Vineet Pandey + 1 · Published 2019-12-18 · Updated 2020-03-31 · CVE-2019-15600

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions http server versions all

Description A path traversal issue exists, allowing an attacker to read arbitrary system files. Additionally, all versions of http server are vulnerable to Cross-Site Scripting (XSS) due to the failure to sanitize filenames, enabling attackers to execute arbitrary JavaScript in the victim's browser through files with malicious code in their names.

Recommendations For all versions, consider using an alternative package until a fix is made available. As a temporary workaround, consider restricting access to sensitive system files and avoiding the use of filenames that could contain malicious code.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-15600

GHSA-754X-4JWP-CQP6

Affected Products

Http Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-15600 · Security Note
• https://osv.dev/vulnerability/CVE-2019-15600 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-754x-4jwp-cqp6 · Vendor Advisory
• https://npmjs.com/advisories/1170 · Note
• https://hackerone.com/reports/692262 · Note
• https://hackerone.com/reports/578138 · Note