@elastic/eui (>=0.0.1-prealpha, <=0.0.11), @pl-test/c (>=1.1.0, <=1.1.1) +5 more potentially affected by CVE-2018-3718 via serve (>=6.0.0, <=6.4.10)

serve NPM version =6.0.0, =0.0.1-prealpha, =1.1.0, =7.1.9, =4.1.8, =5.0.0 Source cves: CVE-2018-3718 Source advisory: OSV:GHSA-5RC4-8QQH-VQ7F...

@elastic/eui (>=0.0.1-prealpha, <=0.0.11), @pl-test/c (>=1.1.0, <=1.1.1) +5 more potentially affected by CVE-2018-3718 via serve (>=6.0.0, <=6.4.10)

serve NPM version =6.0.0, =0.0.1-prealpha, =1.1.0, =7.1.9, =4.1.8, =5.0.0 Source cves: CVE-2018-3718 Source advisory: GHSA-5RC4-8QQH-VQ7F...

Directory Traversal

serve-handler is vulnerable to directory traversal. Attackers are able to access explicitly ignored folders using directory traversal characters ../ followed by the ignored folders. This vulnerability is a bypass of the fix for CVE-2018-3718...

CVE-2018-3718

serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded...

@elastic/eui (>=0.0.1-prealpha, <=0.0.11), @jimpick/lambda-comments-frontend (>=0.0.1, <=0.0.3) +56 more potentially affected by CVE-2018-3718 via serve (>=1.2.0, <=6.4.10)

serve NPM version =1.2.0, =0.0.1-prealpha, =0.0.1, =0.0.2, =1.1.0, =1.0.0, =0.0.0-alpha, =1.0.0, =1.0.0, =2.0.0 and more Source cves: CVE-2018-3718 Source advisory: MEND:CVE-2018-3718...

CVE-2018-3718

serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded...