Lucene search

GitHub Advisory DatabaseGHSA-2J5X-56P6-HJ6X

HistorySep 04, 2019 - 10:02 a.m.

Path Traversal in statichttpserver

2019-09-0410:02:14

CWE-22

GitHub Advisory Database

github.com

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

0.001 Low

EPSS

Percentile

48.5%

JSON

All versions of statichttpserver are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.

Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected configurations

Vulners

Node

statichttpserver_projectstatichttpserverRange≤0.9.7node.js

CPENameOperatorVersion
statichttpserverle0.9.7

CPE	Name	Operator	Version
	statichttpserver	le	0.9.7

References

github.com/advisories/GHSA-2j5x-56p6-hj6x

hackerone.com/reports/570035

nvd.nist.gov/vuln/detail/CVE-2019-5480

www.npmjs.com/advisories/1143

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

0.001 Low

EPSS

Percentile

48.5%

JSON

Related for GHSA-2J5X-56P6-HJ6X