GitHub Advisoryadvisory · npm

GHSA-2j5x-56p6-hj6x Path Traversal in statichttpserver

MEDIUM Published 2019-09-04 Modified 2023-09-12 Official page ↗
Aliases
CVE-2019-5480
Ecosystem
npm
Packages
statichttpserver
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-22
Reviewed
2019-09-04

Affected packages

• npm statichttpserver: <= 0.9.7 (no fix yet)

Description

All versions of `statichttpserver` are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths. Recommendation No fix is currently available. Consider using an alternative package until a fix is made available.

Related

Alias · CVE (1)

  • CVE-2019-5480 A path traversal vulnerability in <= v0.9.7 of statichttpserver npm module allows attackers to list files in arbitrary folders. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References