Node.js st module Directory Traversal

A directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e encoded dot dot in an unspecified path. id: CVE-2014-3744 info: name: Node.js st module Directory Traversal author: geeknik severity: high description: A...

@w3sec/goof (1.1.0), door (>=0.0.5, <=0.0.6) +5 more potentially affected by CVE-2014-3744 via st (>=0.0.12, <=0.2.4)

st NPM version =0.0.12, =0.0.5, =1.0.0, =0.0.0, =0.0.0-a10, =0.1.0, =0.0.1, =0.0.12 Source cves: CVE-2014-3744 Source advisory: OSV:GHSA-69RR-WVH9-6C4Q...

CVE-2014-3744

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e encoded dot dot in an unspecified path...

CVE-2014-3744

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e encoded dot dot in an unspecified path...

CVE-2014-3744

The CVE-2014-3744 issue is a directory traversal vulnerability in the Node.js st module prior to 0.2.5. Vulnerable versions mishandle URL-encoded dots (e.g., %2e and %2e%2e), allowing remote attackers to read arbitrary files on the server. Evidence from multiple sources confirms the affected comp...