GitHub Advisoryadvisory · npm
GHSA-69rr-wvh9-6c4q Directory Traversal in st
HIGH
Official page ↗
- Aliases
- CVE-2014-3744
- Ecosystem
- npm
- Packages
- st
- Severity
- High
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-22
- Reviewed
- 2020-08-31
Affected packages
• npm st: < 0.2.5 → fixed in 0.2.5
Description
Versions of `st` prior to 0.2.5 are affected by a directory traversal vulnerability. Vulnerable versions fail to properly handle URL encoded dots, which caused `%2e` to be interpreted as `.` by the filesystem, resulting the potential for an attacker to read sensitive files on the server.
Recommendation
Update to version 0.2.5 or later.
Related
Alias · CVE (1)
- CVE-2014-3744 Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e… vulnerability
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2014-3744 advisory
- https://github.com/isaacs/st package
- https://github.com/isaacs/st#security-status web
- https://www.npmjs.com/advisories/36 web
- http://www.openwall.com/lists/oss-security/2014/05/13/1 web
- http://www.openwall.com/lists/oss-security/2014/05/15/2 web
- http://www.securityfocus.com/bid/67389 web