@angular/build (>=18.0.0 <=18.1.0-next.2), @avorati/strapi-plugin-preview (=1.0.1) +83 more potentially affected by CVE-2024-31207 via vite (>=5.2.0 <=5.2.4)

vite NPM version =5.2.0, =18.0.0, =5.0.0-alpha.4, =0.1.0-rc.8, =8.31.0, =3.0.2, =3.5.0, =4.1.0, =34.0.0, =2.1.3, =1.2.0, =0.2.24, =11.17.0, =2.0.0, =8.0.8, =8.1.0 and more Source cves: CVE-2024-31207 Source advisory: OSV:GHSA-8JHW-289H-JH2G...

128981semzub (=1.0.1), 1food-menu (>=0.3.0 <=0.3.7) +3129 more potentially affected by CVE-2024-31207 via vite (>=4.0.0 <=4.5.2)

vite NPM version =4.0.0, =0.3.0, =1.0.0, =2.0.3, =0.0.1, =0.0.1, =0.0.7, =4.0.61, =4.0.61, =4.0.61, =4.0.61, =0.0.1, =0.0.3 and more Source cves: CVE-2024-31207 Source advisory: OSV:GHSA-8JHW-289H-JH2G...

@aem-vite/import-rewriter (>=5.0.1 <=6.0.1), @aem-vite/vite-aem-plugin (>=1.0.0 <=2.3.1) +124 more potentially affected by CVE-2024-31207 via vite (>=2.7.0 <=2.9.17)

vite NPM version =2.7.0, =5.0.1, =1.0.0, =3.0.0-beta.5, =3.0.0-beta.2, =0.10.0, =1.1.0-next.4, =0.0.0-experimental-17c6886-20220324, =0.0.0-canary-20220428124037, =0.1.5, =0.0.11, =0.0.12, =0.0.1, =0.1.5, =0.0.11, =0.0.37, =0.0.42 and more Source cves: CVE-2024-31207 Source advisory:...

@aklesky/vite-config (>=0.7.9 <=0.9.0), @angular-devkit/build-angular (>=17.1.0 <=17.2.3) +91 more potentially affected by CVE-2024-31207 via vite (>=5.0.0 <=5.0.12)

vite NPM version =5.0.0, =0.7.9, =17.1.0, =0.5.0, =0.9.0, =4.20.4, =1.0.8, =17.2.4-snapshot-1710342685688, =17.2.4-snapshot-1710342685688, =0.0.1, =11.12.0-beta.0, =1.0.0, =1.1.5 and more Source cves: CVE-2024-31207 Source advisory: OSV:GHSA-8JHW-289H-JH2G...

GHSA-8JHW-289H-JH2G Vite's `server.fs.deny` did not deny requests for patterns with directories.

Summary Vite dev server option server.fs.deny did not deny requests for patterns with directories. An example of such a pattern is /foo//. Impact Only apps setting a custom server.fs.deny that includes a pattern with directories, and explicitly exposing the Vite dev server to the network using...

Vite's `server.fs.deny` did not deny requests for patterns with directories.

Summary Vite dev server option server.fs.deny did not deny requests for patterns with directories. An example of such a pattern is /foo//. Impact Only apps setting a custom server.fs.deny that includes a pattern with directories, and explicitly exposing the Vite dev server to the network using...

@aklesky/vite-config (>=0.7.9 <=0.9.0), @angular-devkit/build-angular (>=17.1.0 <=17.1.0-rc.1) +54 more potentially affected by CVE-2023-34092 +1 more via vite (>=5.0.0 <=5.0.11)

vite NPM version =5.0.0, =0.7.9, =17.1.0, =0.5.0, =4.20.4, =0.0.1, =11.12.0-beta.0, =1.0.0, =7.0.0, =1.0.0-beta.10, =0.38.0, =0.40.0 and more Source cves: CVE-2023-34092, CVE-2024-23331 Source advisory: OSV:GHSA-C24V-8RFC-W8VW...

1food-menu (>=0.0.1 <=0.2.3), 7qb-cli (=2.0.0) +1112 more potentially affected by CVE-2023-34092 +1 more via vite (>=3.0.0 <=3.2.7)

vite NPM version =3.0.0, =0.0.1, =2.0.0, =1.0.1, =1.0.2, =0.0.42-beta1, =0.0.0, =0.0.5, =1.2.56-alpha.0, =1.3.4, =1.0.0, =1.0.22, =1.0.7, =1.2.60 and more Source cves: CVE-2023-34092, CVE-2024-23331 Source advisory: OSV:GHSA-C24V-8RFC-W8VW...

GHSA-C24V-8RFC-W8VW Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem

Summary Vite dev server option server.fs.deny can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to https://nvd.nist.gov/vuln/detail/CVE-2023-34092 -- with surface area reduced to host...

@aem-vite/import-rewriter (>=5.0.1 <=6.0.1), @aem-vite/vite-aem-plugin (>=1.0.0 <=2.3.1) +124 more potentially affected by CVE-2023-34092 +1 more via vite (>=2.7.0 <=2.9.16)

vite NPM version =2.7.0, =5.0.1, =1.0.0, =3.0.0-beta.5, =3.0.0-beta.2, =0.10.0, =1.1.0-next.4, =0.0.0-experimental-17c6886-20220324, =0.0.0-canary-20220428124037, =0.1.5, =0.0.11, =0.0.12, =0.0.1, =0.1.5, =0.0.11, =0.0.37, =0.0.42 and more Source cves: CVE-2023-34092, CVE-2024-23331 Source...

128981semzub (=1.0.1), 1food-menu (>=0.3.0 <=0.3.7) +2882 more potentially affected by CVE-2023-34092 +1 more via vite (>=4.0.0 <=4.5.14)

vite NPM version =4.0.0, =0.3.0, =1.0.0, =2.0.3, =0.0.1, =0.0.1, =0.0.7, =4.0.61, =4.0.61, =4.0.61, =4.0.61, =0.0.1, =0.0.3 and more Source cves: CVE-2023-34092, CVE-2024-23331 Source advisory: OSV:GHSA-C24V-8RFC-W8VW...

GHSA-C24V-8RFC-W8VW vulnerabilities

Vulnerabilities for packages: vite...

GHSA-C24V-8RFC-W8VW vulnerabilities

Vulnerabilities for packages: vite...

Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem

Summary Vite dev server option server.fs.deny can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to https://nvd.nist.gov/vuln/detail/CVE-2023-34092 -- with surface area reduced to host...

CVE-2024-23331

Vite is a frontend tooling framework for javascript. The Vite dev server option server.fs.deny can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to CVE-2023-34092 -- with surface area...

CVE-2024-23331 vulnerabilities

Vulnerabilities for packages: vite...

CVE-2024-23331 vulnerabilities

Vulnerabilities for packages: vite...

Design/Logic Flaw

Vite is a frontend tooling framework for javascript. The Vite dev server option server.fs.deny can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to CVE-2023-34092 -- with surface area...

CVE-2024-23331 Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem

Vite is a frontend tooling framework for javascript. The Vite dev server option server.fs.deny can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to CVE-2023-34092 -- with surface area...

CVE-2024-23331 Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem

Vite is a frontend tooling framework for javascript. The Vite dev server option server.fs.deny can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to CVE-2023-34092 -- with surface area...