GitHub Advisoryadvisory · npm

GHSA-fm87-46vv-jqrr Path Traversal in html-pages

CRITICAL Published 2018-09-18 Modified 2023-01-31 Official page ↗
Aliases
CVE-2018-3744
Ecosystem
npm
Packages
html-pages
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-22, CWE-35
Reviewed
2020-06-16

Affected packages

• npm html-pages: <= 2.1.2 (no fix yet)

Description

Versions of `html-pages` before 2.1.0 are vulnerable to path traversal. Recommendation Update to version 2.1.0 or later.

Related

Alias · CVE (1)

  • CVE-2018-3744 The html-pages node module contains a path traversal vulnerabilities that allows an attacker to read any file from the server with cURL. vulnerability

Weakness · CWE (2)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-35 Path Traversal: '.../...//' weakness

References