PT-2019-20037 · Algo · Algo-Httpserv

Published 2019-09-11 · Updated 2019-09-11

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions algo-httpserv versions prior to 1.1.2

Description The issue is due to insufficient input sanitization, allowing attackers to access server files by using relative paths. This can lead to a Path Traversal attack.

Recommendations Upgrade to version 1.1.2 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

GHSA-CGJV-RGHQ-QHGP

Affected Products

Algo-Httpserv

References · 4

• https://osv.dev/vulnerability/GHSA-cgjv-rghq-qhgp · Vendor Advisory
• https://github.com/AlgoRythm-Dylan/httpserv/commit/bcfe9d4316c2b59aab3a64a38905376026888735 · Note
• https://snyk.io/vuln/SNYK-JS-ALGOHTTPSERV-174741 · Note
• https://npmjs.com/advisories/889 · Note