GitHub Advisoryadvisory · npm

GHSA-gvff-25cc-4f66 Path Traversal in restify-swagger-jsdoc

HIGH Published 2020-09-03 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
restify-swagger-jsdoc
Severity
High
Weaknesses
CWE-22
Reviewed
2020-08-31

Affected packages

• npm restify-swagger-jsdoc: < 3.2.1 → fixed in 3.2.1

Description

Versions of `restify-swagger-jsdoc` prior to 3.2.1 are vulnerable to Path Traversal. The package fails to properly sanitize URLs, which may allow attackers to access server files outside the `swagger-ui` folder by using relative paths. Recommendation Upgrade to version 3.2.1 or later.

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References