Lucene search

GitHub Advisory DatabaseGHSA-2MP5-M968-GWR2

HistoryJul 16, 2019 - 12:41 a.m.

Path Traversal in http-file-server

2019-07-1600:41:34

CWE-22

GitHub Advisory Database

github.com

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

0.001 Low

EPSS

Percentile

48.3%

JSON

All versions of http-file-server are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.

Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected configurations

Vulners

Node

http_file_server_projecthttp_file_serverRange<0.2.6

CPENameOperatorVersion
http-file-serverlt0.2.6

CPE	Name	Operator	Version
	http-file-server	lt	0.2.6

References

github.com/advisories/GHSA-2mp5-m968-gwr2

hackerone.com/reports/570133

nvd.nist.gov/vuln/detail/CVE-2019-5447

www.npmjs.com/advisories/1077

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

0.001 Low

EPSS

Percentile

48.3%

JSON

Related for GHSA-2MP5-M968-GWR2