PT-2019-20071 · M-Server · M-Server

Published 2019-06-11 · Updated 2019-06-11

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions m-server versions prior to 1.4.2

Description The issue allows a remote attacker to display content of arbitrary files from the server due to path traversal.

Recommendations Update to version 1.4.2 or later.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

GHSA-VC6R-4X6G-MMQC

Affected Products

M-Server

References · 5

• https://osv.dev/vulnerability/GHSA-vc6r-4x6g-mmqc · Vendor Advisory
• https://github.com/nodejs/security-wg/blob/master/vuln/npm/468.json · Note
• https://github.com/nunnly/m-server/commit/01f13f040d1961ca3146dce7e2db990156e65e9a · Note
• https://npmjs.com/advisories/731 · Note
• https://hackerone.com/reports/319795 · Note