GitHub Advisoryadvisory · npm

GHSA-f5mh-hq6h-whxv Directory Traversal in bitty

MEDIUM Published 2019-02-18 Modified 2021-01-08 Official page ↗
Aliases
CVE-2016-10561
Ecosystem
npm
Packages
bitty
Severity
Moderate
Weaknesses
CWE-22
Reviewed
2020-06-16

Affected packages

• npm bitty: <= 0.2.10 (no fix yet)

Description

Affected versions of `bitty` are vulnerable to directory traversal via the URL path in GET requests. Recommendation The `bitty` package is not currently maintained, and has not seen an update since 2015. At this time, the best available mitigation is to use an alternative module that is actively maintained and provides similar functionality, such as serve.

Related

Alias · CVE (1)

  • CVE-2016-10561 Bitty is a development web server tool that functions similar to `python -m SimpleHTTPServer`. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References