Local File Inclusion (LFI)

🗓️ 20 Sep 2024 10:52:34Reported by Veracode Vulnerability DatabaseType

vite allows arbitrary file exposure due to improper file access restrictions in the @fs mechanism.

Reporter	Title	Published	Views	Family All 51
Chainguard	CVE-2024-45811 vulnerabilities	17 Sep 202420:15	–	cgr
Circl	CVE-2024-45811	17 Sep 202423:08	–	circl
CNNVD	Vite 访问控制错误漏洞	17 Sep 202400:00	–	cnnvd
CVE	CVE-2024-45811	17 Sep 202420:08	–	cve
Cvelist	CVE-2024-45811 server.fs.deny bypassed when using ?import&raw in vite	17 Sep 202420:08	–	cvelist
EUVD	EUVD-2024-2759	3 Oct 202520:07	–	euvd
Github Security Blog	Vite's `server.fs.deny` is bypassed when using `?import&raw`	17 Sep 202418:44	–	github
NVD	CVE-2024-45811	17 Sep 202420:15	–	nvd
OPENSUSE Linux	velociraptor-0.7.0.4.git142.862ef23-1.1 on GA media (moderate)	18 Jan 202500:00	–	opensuse
OSV	CGA-2RRM-CFWM-848J	25 Sep 202405:12	–	osv

Vulners

Node

vitejs viteRange5.4.0-beta.0–5.4.5js

vitejs viteRange5.3.0–5.3.5js

vitejs viteRange4.0.0–4.5.3js

vitejs viteRange0.1.0–3.2.10js

vitejs viteRange5.2.0–5.2.13js

vitejs viteRange5.0.0–5.1.7js

Source	Link
github	www.github.com/vitejs/vite/commit/b901438f99e667f76662840826eec91c8ab3b3e7
github	www.github.com/vitejs/vite/commit/8339d7408668686bae56eaccbfdc7b87612904bd
github	www.github.com/vitejs/vite/commit/4573a6fd6f1b097fb7296a3e135e0646b996b249
github	www.github.com/vitejs/vite/commit/6820bb3b9a54334f3268fc5ee1e967d2e1c0db34
github	www.github.com/vitejs/vite/commit/a6da45082b6e73ddfdcdcc06bb5414f976a388d6
github	www.github.com/advisories/GHSA-9cwx-2883-4wfx

27 Sep 2024 10:02Current

5.1Medium risk

Vulners AI Score5.1

CVSS 3.14.8

EPSS0.00015

SSVC