GitHub Advisoryadvisory · npm

GHSA-45j8-pm75-5v8x Path Traversal in simplehttpserver

HIGH Published 2019-02-07 Modified 2020-08-31 Official page ↗
Aliases
CVE-2018-16493
Ecosystem
npm
Packages
static-resource-server
Severity
High
Weaknesses
CWE-548
Reviewed
2020-06-16

Affected packages

• npm static-resource-server: <= 1.7.2 (no fix yet)

Description

Versions of `simplehttpserver` prior to 0.2.1 are vulnerable to Path Traversal. Due to insufficient input sanitization, attackers can access server files by using relative paths. Recommendation Upgrade to version 0.2.1 or later.

Related

Alias · CVE (1)

  • CVE-2018-16493 A path traversal vulnerability was found in module static-resource-server 1.7.2 that allows unauthorized read access to any file on the… vulnerability

Weakness · CWE (1)

  • CWE-548 Exposure of Information Through Directory Listing weakness

References