GitHub Advisoryadvisory · npm

GHSA-7c9w-qmrq-ff8r Path Traversal in http-live-simulator

HIGH Published 2019-02-07 Modified 2020-08-31 Official page ↗
Aliases
CVE-2018-16479
Ecosystem
npm
Packages
http-live-simulator
Severity
High
Weaknesses
CWE-22
Reviewed
2020-06-16

Affected packages

• npm http-live-simulator: < 1.0.7 → fixed in 1.0.7

Description

Versions of `http-live-simulator` prior to 1.0.7 are vulnerable to Path Traversal. Due to insufficient input sanitization, attackers can access server files by using relative paths. For example: `curl --path-as-is http://localhost:8080//../../../../etc/passwd`. Recommendation Upgrade to version 1.0.7

Related

Alias · CVE (1)

  • CVE-2018-16479 Path traversal vulnerability in http-live-simulator <1.0.7 causes unauthorized access to arbitrary files on disk by appending extra slashes… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References