GitHub Advisoryadvisory · npm

GHSA-44g9-w23c-5rw7 Directory Traversal in nhouston

MEDIUM Published 2020-08-31 Modified 2021-09-23 Official page ↗
Aliases
CVE-2014-8883
Ecosystem
npm
Packages
nhouston
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-23
Reviewed
2020-08-31

Affected packages

• npm nhouston: >= 0.0.0 (no fix yet)

Description

All versions of the static file server module nhouston are vulnerable to directory traversal. An attacker can provide input such as `../` to read files outside of the served directory. Recommendation It is recommended that a different module be used, as we have been unable to reacher the maintainer of this module. We will continue to reach out to them, and if an update becomes available that fixes the issue, we will update this advisory accordingly.

Related

Alias · not in database (1)

Weakness · CWE (1)

  • CWE-23 Relative Path Traversal weakness

References