GitHub Advisoryadvisory · npm
GHSA-cv3v-7846-6pxm Unauthorized File Access in node-git-server
HIGH
Official page ↗
- Ecosystem
- npm
- Packages
- node-git-server
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-552
- Reviewed
- 2020-08-31
Affected packages
• npm node-git-server: >= 0.2.0, < 0.6.1 → fixed in 0.6.1
Description
Versions of `node-git-server` prior to 0.6.1 are vulnerable to Unauthorized File Access. It is possible to access any git repository by using absolute paths, which may allow attackers to access private repositories.
Recommendation
Upgrade to version 0.6.1 or later.
Related
Weakness · CWE (1)
- CWE-552 Files or Directories Accessible to External Parties weakness
References
- https://github.com/gabrielcsapo/node-git-server/pull/62 web
- https://github.com/gabrielcsapo/node-git-server/commit/ac26650f69bc445d71e4f2c55328676d10a4be43 web
- https://github.com/gabrielcsapo/node-git-server/commit/fb8d62710e3d78c796e04a33fcff66cea3f212f3 web
- https://github.com/gabrielcsapo/node-git-server package
- https://github.com/gabrielcsapo/node-git-server/blob/0.2.0/lib/git.js web
- https://github.com/gabrielcsapo/node-git-server/tree/0.1.0 web
- https://snyk.io/vuln/SNYK-JS-NODEGITSERVER-474343 web