Lucene search

GitHub Advisory DatabaseGHSA-23XP-J737-282V

HistoryNov 06, 2018 - 11:12 p.m.

Path Traversal in takeapeek

2018-11-0623:12:30

CWE-22

GitHub Advisory Database

github.com

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

49.2%

JSON

All versions of takeapeek are vulnerable to path traversal exposing files and directories.

Recommendation

As no fix is currently available for this vulnerability is it is our recommendation to use another static file server.

Affected configurations

Vulners

Node

takeapeek_projecttakeapeekRange≤0.2.2node.js

VendorProductVersionCPE
takeapeek_projecttakeapeek*cpe:2.3:a:takeapeek_project:takeapeek:*:*:*:*:*:node.js:*:*

Vendor	Product	Version	CPE
takeapeek_project	takeapeek	*	cpe:2.3:a:takeapeek_project:takeapeek::::::node.js::*

References

github.com/advisories/GHSA-23xp-j737-282v

github.com/nodejs/security-wg/blob/master/vuln/npm/478.json

hackerone.com/reports/403736

nvd.nist.gov/vuln/detail/CVE-2018-16473

www.npmjs.com/advisories/740

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

49.2%

JSON

Related for GHSA-23XP-J737-282V