Lucene search
GoogleOSV:GHSA-V633-X5VV-HQWCHistoryOct 24, 2017 - 6:33 p.m.
Cross-Site Scripting in serve-index
2017-10-2418:33:36
Google
osv.dev
10
EPSS
0.001
Percentile
50.1%
Versions 1.6.2 and earlier of serve-index are affected by a cross-site scripting vulnerability. Because file and directory names are not escaped in the module’s HTML output, a remote attacker that can influence file or directory names can launch a persistent cross-site scripting attack on the application.
Recommendation
Update to version 1.6.3 or later.
References
www.openwall.com/lists/oss-security/2016/04/20/11
github.com/expressjs/serve-index
github.com/expressjs/serve-index/commit/7381a1d1458959e57ee53ac932b06ff17904777e
github.com/expressjs/serve-index/issues/28
nvd.nist.gov/vuln/detail/CVE-2015-8856
web.archive.org/web/20200227190911/www.securityfocus.com/bid/96392
Related
debiancve
debiancve
CVE-2015-8856
2017-01-23 21:59:00
github
github
Cross-Site Scripting in serve-index
2017-10-24 18:33:36
cve
cve
CVE-2015-8856
2017-01-23 21:59:00
ubuntucve
ubuntucve
CVE-2015-8856
2017-01-23 00:00:00
nodejs
nodejs
Cross-Site Scripting
2015-10-17 19:41:46
prion
prion
Cross site scripting
2017-01-23 21:59:00
cvelist
cvelist
CVE-2015-8856
2017-01-23 21:00:00
nvd
nvd
CVE-2015-8856
2017-01-23 21:59:00
veracode
veracode
Cross-site Scripting (XSS)
2018-03-01 03:10:54
