GitHub Advisoryadvisory · npm

GHSA-46hv-7769-j7rx Unauthorized File Access in harp

MEDIUM Published 2019-06-13 Modified 2023-09-07 Official page ↗
Aliases
CVE-2019-5437
Ecosystem
npm
Packages
harp
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-548
Reviewed
2019-06-13

Affected packages

• npm harp: < 0.40.2 → fixed in 0.40.2

Description

Affected versions of `harp` are vulnerable to Unauthorized File Access. The package states that it ignores files and directories with names that start with an underscore, such as `_secret-folder`. If the underscore character is URL encoded the server delivers the file. Recommendation Upgrade to version `0.40.2` or later.

Related

Alias · CVE (1)

  • CVE-2019-5437 Information exposure through the directory listing in npm's harp module allows to access files that are supposed to be ignored according to… vulnerability

Weakness · CWE (1)

  • CWE-548 Exposure of Information Through Directory Listing weakness

References