GitHub Advisoryadvisory · npm

GHSA-jgqf-hwc5-hh37 Root Path Disclosure in send

MEDIUM Published 2017-10-24 Modified 2021-09-14 Official page ↗
Aliases
CVE-2015-8859
Ecosystem
npm
Packages
send
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2020-06-16

Affected packages

• npm send: < 0.11.1 → fixed in 0.11.1

Description

Versions of `send` prior to 0.11.2 are affected by an information leakage vulnerability which may allow an attacker to enumerate paths on the server filesystem. Recommendation Update to version 0.11.1 or later.

Related

Alias · CVE (1)

  • CVE-2015-8859 The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References