5.8 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
5.8 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
40.3%
Http4s is a Scala interface for HTTP services. StaticFile.fromUrl
can leak the presence of a directory on a server when the URL
scheme is not file://
, and the URL points to a fetchable resource under its scheme and authority. The function returns F[None]
, indicating no resource, if url.getFile
is a directory, without first checking the scheme or authority of the URL. If a URL connection to the scheme and URL would return a stream, and the path in the URL exists as a directory on the server, the presence of the directory on the server could be inferred from the 404 response. The contents and other metadata about the directory are not exposed. This affects http4s versions: 0.21.7 through 0.21.23, 0.22.0-M1 through 0.22.0-M8, 0.23.0-M1, and 1.0.0-M1 through 1.0.0-M22. The patch is available in the following versions: v0.21.24, v0.22.0-M9, v0.23.0-M2, v1.0.0-M23. As a workaround users can avoid calling StaticFile.fromUrl
with non-file URLs.
[
{
"product": "http4s",
"vendor": "http4s",
"versions": [
{
"status": "affected",
"version": ">= 0.21.7, < 0.21.24"
},
{
"status": "affected",
"version": ">= 0.22.0-M1, <= 0.22.0-M8"
},
{
"status": "affected",
"version": "= 0.23.0-M1"
},
{
"status": "affected",
"version": ">= 1.0.0-M1, < 1.0.0-M23"
}
]
}
]
5.8 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
5.8 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
40.3%