Lucene search
Veracode Vulnerability DatabaseVERACODE:21402HistoryAug 30, 2019 - 3:13 a.m.
Local File Inclusion
2019-08-3003:13:36
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
7
0.001 Low
EPSS
Percentile
42.0%
larvitbase-api is vulnerable to local file inclusion. The package uses an exposed API endpoint that accepts an unvalidated GET parameter to a require() function call. This could potentially allow a remote attacker to execute any .js files within the web server. Successful exploitation causes the server to crash.
| CPE | Name | Operator | Version |
|---|---|---|---|
| larvitbase-api | le | 0.5.3 |
References
Related
nvd
nvd
CVE-2019-5479
2019-09-03 20:15:11
osv
osv
Unintended Require in larvitbase-api
2019-09-11 23:03:57
cvelist
cvelist
CVE-2019-5479
2019-09-03 19:15:47
github
github
Unintended Require in larvitbase-api
2019-09-11 23:03:57
cve
cve
CVE-2019-5479
2019-09-03 20:15:11
hackerone
hackerone
Node.js third-party modules: [larvitbase-api] Unintended Require
2019-05-04 10:15:45
prion
prion
Code injection
2019-09-03 20:15:00
githubexploit
githubexploit