Vite 跨站脚本漏洞

Vite is a new front-end builder tool open-sourced by Vite. A cross-site scripting vulnerability exists in Vite. An attacker exploiting this vulnerability could perform a cross-site scripting attack...

PT-2024-31792 · Vite · Vite

Name of the Vulnerable Software and Affected Versions: Vite versions prior to 3.2.11 Vite versions prior to 4.5.5 Vite versions prior to 5.2.14 Vite versions prior to 5.3.6 Vite versions prior to 5.4.6 Description: The contents of arbitrary files can be returned to the browser. @fs denies access ...

PT-2024-31793 · Vite · Vite

Name of the Vulnerable Software and Affected Versions: Vite versions prior to 3.2.11 Vite versions prior to 4.5.5 Vite versions prior to 5.2.14 Vite versions prior to 5.3.6 Vite versions prior to 5.4.6 Description: A DOM Clobbering vulnerability was discovered in Vite when building scripts to...

The vulnerability of the Vite application development local server, related to access control deficiencies, allows a hacker to execute arbitrary code.

The vulnerability of the Vite application development local server is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2024-31207

A flaw was found in the Node.js Vite package. When configuring the "server.fs.deny" server option to deny requests that include a pattern with directories such as /foo//, the requests were still being allowed. This can potentially expose files or directories containing sensitive information. Only...

CVE-2024-31207

Vite French word for "quick", pronounced /vit/, like "veet" is a frontend build tooling to improve the frontend development experience.server.fs.deny does not deny requests for patterns with directories. This vulnerability has been patched in versions 5.2.6, 5.1.7, 5.0.13, 4.5.3, 3.2.10 and 2.9.1...

CVE-2024-31207

CVE-2024-31207 (Vite) : The vulnerability is in Vite’s server.fs.deny logic, which does not deny requests for patterns containing directories. This could allow access to unintended files or paths during development. Affected versions include 2.9.18 and 3.2.10 up to 5.2.6, 5.1.7, 5.0.13, and 4.5.3...

CVE-2024-31207 Vite's `server.fs.deny` did not deny requests for patterns with directories

Vite French word for "quick", pronounced /vit/, like "veet" is a frontend build tooling to improve the frontend development experience.server.fs.deny does not deny requests for patterns with directories. This vulnerability has been patched in versions 5.2.6, 5.1.7, 5.0.13, 4.5.3, 3.2.10 and 2.9.1...

CVE-2024-31207 Vite's `server.fs.deny` did not deny requests for patterns with directories

Vite French word for "quick", pronounced /vit/, like "veet" is a frontend build tooling to improve the frontend development experience.server.fs.deny does not deny requests for patterns with directories. This vulnerability has been patched in versions 5.2.6, 5.1.7, 5.0.13, 4.5.3, 3.2.10 and 2.9.1...

CVE-2024-31207 Vite's `server.fs.deny` did not deny requests for patterns with directories

Vite French word for "quick", pronounced /vit/, like "veet" is a frontend build tooling to improve the frontend development experience.server.fs.deny does not deny requests for patterns with directories. This vulnerability has been patched in versions 5.2.6, 5.1.7, 5.0.13, 4.5.3, 3.2.10 and 2.9.1...

Path Traversal

vite is vulnerable to Path Traversal. The vulnerability is due to mishandling patterns containing directories caused by the server.fs.deny option. This allows an attacker to gain unauthorized access to certain files...

Vite 安全漏洞

Vite is a new front-end builder tool open-sourced by Vite. A security vulnerability exists in Vite that stems from server.fs.deny not rejecting requests with directory patterns. Affected products and versions: Vite versions 2.7.0 through 2.9.17, 3.0.0 through 3.2.8, 4.0.0 through 4.5.2, 5.0.0...

@akrc/vidocs (>=0.0.0, <=0.0.2), @alexzzz/npms (>=0.0.5, <=0.2.0) +136 more potentially affected by CVE-2024-31207 via vite (>=3.0.0, <=3.2.8)

vite NPM version =3.0.0, =0.0.0, =0.0.5, =1.0.1, =1.0.1, =3.2.0, =1.11.2, =0.0.37, =0.0.35, =0.2.3, =0.0.0-canary-20220718083044, =0.0.6, =0.1.0, =0.0.3, =6.24.0, =7.12.2 and more Source cves: CVE-2024-31207 Source advisory: OSV:GHSA-8JHW-289H-JH2G...

@aklesky/vite-config (>=0.7.9, <=0.9.0), @angular-devkit/build-angular (>=17.1.0-next.0, <=17.2.3) +126 more potentially affected by CVE-2024-31207 via vite (>=5.0.0, <=5.0.12)

vite NPM version =5.0.0, =0.7.9, =17.1.0-next.0, =1.0.25-beta.0, =0.5.0, =0.22.0, =1.0.0-rc.12, =0.9.0, =4.20.4, =1.0.0-dev.74fcb60, =1.0.274, =0.40.2, =1.0.8, =1.0.17 - @eagle-tracker-plugin/vite-plugin 1.0.0 - @eagle-tracker-plugin/webpack-plugin 1.0.0 - @equinor/roma-nx-plugin 0.0.21 and more...

Vite's `server.fs.deny` did not deny requests for patterns with directories.

Summary Vite dev server option server.fs.deny did not deny requests for patterns with directories. An example of such a pattern is /foo//. Impact Only apps setting a custom server.fs.deny that includes a pattern with directories, and explicitly exposing the Vite dev server to the network using...

@4399ywkf/bundler-vite (>=4.0.61, <=4.0.84), @4399ywkf/js (>=4.0.61, <=4.0.84) +479 more potentially affected by CVE-2024-31207 via vite (>=4.0.0, <=4.5.2)

vite NPM version =4.0.0, =4.0.61, =4.0.61, =4.0.61, =4.0.61, =0.0.1, =0.0.0, =0.0.1, =0.0.3, =0.0.1, =0.0.1, =0.0.1, =3.3.9-patch.1, =3.3.9-patch.2 and more Source cves: CVE-2024-31207 Source advisory: OSV:GHSA-8JHW-289H-JH2G...

GHSA-8JHW-289H-JH2G Vite's `server.fs.deny` did not deny requests for patterns with directories.

Summary Vite dev server option server.fs.deny did not deny requests for patterns with directories. An example of such a pattern is /foo//. Impact Only apps setting a custom server.fs.deny that includes a pattern with directories, and explicitly exposing the Vite dev server to the network using...

@angular-devkit/build-angular (18.0.0-next.0), @eui/deps-base (>=18.0.0-next.1, <=18.0.0-next.2) +10 more potentially affected by CVE-2024-31207 via vite (>=5.2.0, <=5.2.4)

vite NPM version =5.2.0, =18.0.0-next.1, =18.0.0-next.1, =1.0.2, =0.0.39, =1.1.3, =1.1.9, =0.1.3, =0.20.0-beta.3, =0.20.0 Source cves: CVE-2024-31207 Source advisory: OSV:GHSA-8JHW-289H-JH2G...

@aem-vite/import-rewriter (>=5.0.1, <=6.0.1), @aem-vite/vite-aem-plugin (>=1.0.0-alpha.1, <=2.3.1) +145 more potentially affected by CVE-2024-31207 via vite (>=2.7.0, <=2.9.17)

vite NPM version =2.7.0, =5.0.1, =1.0.0-alpha.1, =3.0.0-beta.5, =3.0.0-beta.2, =0.9.1, =1.1.0-next.4, =0.0.0-experimental-17c6886-20220324, =0.0.0-canary-20220428124037, =0.1.5, =0.0.11, =0.0.12, =0.0.1, =0.1.5, =0.0.11, =0.0.37, =0.0.42 and more Source cves: CVE-2024-31207 Source advisory:...

@aem-vite/import-rewriter (>=5.0.1, <=6.0.1), @aem-vite/vite-aem-plugin (>=1.0.0-alpha.1, <=2.3.1) +145 more potentially affected by CVE-2024-23331 via vite (>=2.7.0, <=2.9.16)

vite NPM version =2.7.0, =5.0.1, =1.0.0-alpha.1, =3.0.0-beta.5, =3.0.0-beta.2, =0.9.1, =1.1.0-next.4, =0.0.0-experimental-17c6886-20220324, =0.0.0-canary-20220428124037, =0.1.5, =0.0.11, =0.0.12, =0.0.1, =0.1.5, =0.0.11, =0.0.37, =0.0.42 and more Source cves: CVE-2024-23331 Source advisory:...