Path traversal in webpack-dev-middleware

🗓️ 21 Mar 2024 18:59:28Reported by GitHub Advisory DatabaseType

github

github🔗 github.com👁 41 Views

Middleware allows path traversal to access any file on the developer's machin

Reporter	Title	Published	Views	Family All 50
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data	15 Apr 202502:34	–	ibm
IBM Security Bulletins	Security Bulletin: User Behavior Analytics application add on to IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	10 May 202415:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to webpack webpack-dev-middleware directory transversal vulnerability [CVE-2024-29180]	5 Aug 202420:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container UBI updates	23 Apr 202414:11	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Network Automation 2.7.3 addresses multiple security vulnerabilities	26 Mar 202504:10	–	ibm
IBM Security Bulletins	Security Bulletin: The Log Source Management App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities (CVE-2024-28849, CVE-2024-29041, CVE-2024-29180)	7 May 202420:03	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in components for Cloud Pak System	28 Oct 202417:56	–	ibm
BDU FSTEC	The vulnerability of intermediate software for the Express Webpack-dev-middleware is related to insufficient checking of URL addresses, which allows unauthorized access to protected information.	31 May 202400:00	–	bdu_fstec
Chainguard	CVE-2024-29180 vulnerabilities	21 Mar 202516:12	–	cgr
CNNVD	webpack-dev-middleware 安全漏洞	21 Mar 202400:00	–	cnnvd

Vulners

Node

webpack.js webpack-dev-middlewareRange≤5.3.3npm

OR

webpack.js webpack-dev-middlewareRange6.0.0–6.1.2npm

OR

webpack.js webpack-dev-middlewareRange7.0.0–7.1.0npm

Source	Link
github	www.github.com/webpack/webpack-dev-middleware/security/advisories/GHSA-wr3j-pwj9-hqq6
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-29180
github	www.github.com/webpack/webpack-dev-middleware/commit/189c4ac7d2344ec132a4689e74dc837ec5be0132
github	www.github.com/webpack/webpack-dev-middleware/commit/9670b3495da518fe667ff3428c5e4cb9f2f3d353
github	www.github.com/webpack/webpack-dev-middleware/commit/e10008c762e4d5821ed6990348dabf0d4d93a10e
github	www.github.com/webpack/webpack-dev-middleware/blob/7ed24e0b9f53ad1562343f9f517f0f0ad2a70377/src/utils/getFilenameFromUrl.js
github	www.github.com/webpack/webpack-dev-middleware/blob/7ed24e0b9f53ad1562343f9f517f0f0ad2a70377/src/utils/setupOutputFileSystem.js
github	www.github.com/webpack/webpack-dev-middleware/releases/tag/v5.3.4
github	www.github.com/webpack/webpack-dev-middleware/releases/tag/v6.1.2
github	www.github.com/webpack/webpack-dev-middleware/releases/tag/v7.1.0

21 Mar 2024 18:59Current

6.4Medium risk

Vulners AI Score6.4

CVSS 3.17.4 - 7.5

EPSS0.03394

SSVC

path traversal webpack-dev-middleware local file access security issue exfiltration url normalization cors public ip address