GitHub Advisoryadvisory · npm

GHSA-g4xp-36c3-f7mr Hidden Directories Always Served in inert

MEDIUM Published 2020-08-31 Modified 2020-08-31 Official page ↗
Aliases
CVE-2014-10068
Ecosystem
npm
Packages
inert
Severity
Moderate
Weaknesses
CWE-22
Reviewed
2020-08-31

Affected packages

• npm inert: < 1.1.1 → fixed in 1.1.1

Description

Versions 1.1.1 and earlier of `inert` are vulnerable to an information leakage vulnerability which causes files in hidden directories to be served, even when showHidden is false. The inert directory handler always allows files in hidden directories to be served, even when `showHidden` is false. Recommendation Update to version >= 1.1.1.

Related

Alias · CVE (1)

  • CVE-2014-10068 The inert directory handler in inert node module before 1.1.1 always allows files in hidden directories to be served, even when… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References