Lucene search

GitHub Advisory DatabaseGHSA-WCWM-C3MR-PXCR

HistoryDec 20, 2022 - 6:30 a.m.

easy-static-server vulnerable to Directory Traversal

2022-12-2006:30:36

CWE-22

GitHub Advisory Database

github.com

easy-static-server

directory traversal

input sanitization

user input

server code

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

50.4%

JSON

All versions of package easy-static-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed to the req.url user input that is passed to the server code.

Affected configurations

Vulners

Node

easy-static-server_projecteasy-static-serverRange≤0.1.1node.js

VendorProductVersionCPE
easy-static-server_projecteasy-static-server*cpe:2.3:a:easy-static-server_project:easy-static-server:*:*:*:*:*:node.js:*:*

Vendor	Product	Version	CPE
easy-static-server_project	easy-static-server	*	cpe:2.3:a:easy-static-server_project:easy-static-server::::::node.js::*

References

gist.github.com/lirantal/fdfbe26561788c8194a54bf6d31772c9

github.com/advisories/GHSA-wcwm-c3mr-pxcr

github.com/cunjieliu/easyServer/blob/master/index.js#23L27

nvd.nist.gov/vuln/detail/CVE-2022-25931

security.snyk.io/vuln/SNYK-JS-EASYSTATICSERVER-3153539

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

50.4%

JSON

Related for GHSA-WCWM-C3MR-PXCR