Lucene search

HackeroneCVE-2014-10068

HistoryMay 29, 2018 - 8:29 p.m.

CVE-2014-10068

2018-05-2920:29:00

CWE-22

hackerone

web.nvd.nist.gov

cve-2014-10068

inert

node module

security vulnerability

directory handler

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.002

Percentile

54.1%

JSON

The inert directory handler in inert node module before 1.1.1 always allows files in hidden directories to be served, even when showHidden is false.

Affected configurations

Nvd

Vulners

Node

hapiinertRange<1.1.1node.js

VendorProductVersionCPE
hapiinert*cpe:2.3:a:hapi:inert:*:*:*:*:*:node.js:*:*

Vendor	Product	Version	CPE
hapi	inert	*	cpe:2.3:a:hapi:inert::::::node.js::*

CNA Affected

[
  {
    "product": "inert node module",
    "vendor": "HackerOne",
    "versions": [
      {
        "status": "affected",
        "version": "<1.1.1"
      }
    ]
  }
]

References

github.com/hapijs/inert/commit/e8f99f94da4cb08e8032eda984761c3f111e3e82

github.com/hapijs/inert/pull/15

nodesecurity.io/advisories/14

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.002

Percentile

54.1%

JSON

Related for CVE-2014-10068