Lucene search

GitHub Advisory DatabaseGHSA-G4XP-36C3-F7MR

HistoryAug 31, 2020 - 10:47 p.m.

Hidden Directories Always Served in inert

2020-08-3122:47:41

CWE-22

GitHub Advisory Database

github.com

inert

hidden directories

information leakage

showhidden

software update

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.002

Percentile

54.1%

JSON

Versions 1.1.1 and earlier of inert are vulnerable to an information leakage vulnerability which causes files in hidden directories to be served, even when showHidden is false.

The inert directory handler always allows files in hidden directories to be served, even when showHidden is false.

Recommendation

Update to version >= 1.1.1.

Affected configurations

Vulners

Node

inertRange<1.1.1

VendorProductVersionCPE
*inert*cpe:2.3:a:*:inert:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
*	inert	*	cpe:2.3:a::inert::::::::*

References

github.com/advisories/GHSA-g4xp-36c3-f7mr

github.com/hapijs/inert/commit/e8f99f94da4cb08e8032eda984761c3f111e3e82

github.com/hapijs/inert/pull/15

nvd.nist.gov/vuln/detail/CVE-2014-10068

www.npmjs.com/advisories/14

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.002

Percentile

54.1%

JSON

Related for GHSA-G4XP-36C3-F7MR