PT-2020-7759 · Nhouston · Nhouston

Published 2020-08-31 · Updated 2020-08-31 · CVE-2014-8883

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions nhouston (affected versions not specified)

Description The issue allows an attacker to perform directory traversal by providing input such as ../ to read files outside of the served directory.

Recommendations As a temporary workaround, consider disabling the use of the nhouston module until a patch is available or an alternative module is implemented. It is recommended to use a different module, as the maintainer of nhouston has been unreachable.

Fix

Relative Path Traversal

Weakness Enumeration

CWE-23

Related Identifiers

CVE-2014-8883

GHSA-44G9-W23C-5RW7

Affected Products

Nhouston

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2014-8883 · Security Note
• https://osv.dev/vulnerability/GHSA-44g9-w23c-5rw7 · Vendor Advisory
• https://snyk.io/vuln/npm:nhouston:20141114 · Note
• https://npmjs.com/advisories/25 · Note
• http://en.wikipedia.org/wiki/Directory_traversal_attack · Note