GitHub Advisoryadvisory · npm
GHSA-4rvg-955w-h68q Path Traversal in angular-http-server
MEDIUM
Official page ↗
- Aliases
- CVE-2018-3713
- Ecosystem
- npm
- Packages
- angular-http-server
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-22
- Reviewed
- 2020-06-16
Affected packages
• npm angular-http-server: < 1.6.0 → fixed in 1.6.0
Description
Affected versions of `angular-http-server` are vulnerable to path traversal allowing a remote attacker to read files from the server that uses `angular-http-server`.
Recommendation
Update to version 1.6.0 or later.
:exclamation: Note: This was originally thought to be fixed in version 1.4.3, though according to this issue the vulnerability was not completely fixed until version 1.6.0.
Related
Alias · CVE (1)
- CVE-2018-3713 angular-http-server node module suffers from a Path Traversal vulnerability due to lack of validation of possibleFilename, which allows a… vulnerability
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-3713 advisory
- https://github.com/simonh1000/angular-http-server/pull/21 web
- https://github.com/simonh1000/angular-http-server/commit/34d4bd0cd0f00c46db30855a8c4aabae27eb0ac8 web
- https://hackerone.com/reports/309120 web
- https://github.com/advisories/GHSA-4rvg-955w-h68q advisory
- https://www.npmjs.com/advisories/589 web