Apache Thrift Node.js static web server access control error vulnerability

🗓️ 08 Jan 2019 00:00:00Reported by China National Vulnerability DatabaseType

Thrift Node.js static web server has an access control error in versions 0.9.2 through 0.11.0 enabling remote file access outside the document root.

Reporter	Title	Published	Views	Family All 30
IBM Security Bulletins	Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities	13 Apr 202120:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities in Apache Thrift	20 Jun 202216:01	–	ibm
BDU FSTEC	The vulnerability in the Apache Thrift web server for Node.js exists due to an incorrect pathname limitation for the restricted access directory, allowing attackers to gain access to arbitrary files.	11 Jul 201900:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Apache Thrift interface description language in Node.js allows a hacker to gain unauthorized access to protected information.	3 Dec 201900:00	–	bdu_fstec
Chainguard	CVE-2018-11798 vulnerabilities	7 Jan 201918:00	–	cgr
CVE	CVE-2018-11798	7 Jan 201918:00	–	cve
Cvelist	CVE-2018-11798	7 Jan 201918:00	–	cvelist
Debian CVE	CVE-2018-11798	7 Jan 201918:00	–	debiancve
Tenable Nessus	EulerOS Virtualization 3.0.1.0 : thrift (EulerOS-SA-2019-1458)	14 May 201900:00	–	nessus
EUVD	EUVD-2019-0195	7 Oct 202500:30	–	euvd