GitHub Advisoryadvisory · npm

GHSA-p8j8-wxvp-h695 SimbCo httpster vulnerable to Path Traversal

HIGH Published 2022-12-25 Modified 2023-01-06 Official page ↗
Aliases
CVE-2020-36629
Ecosystem
npm
Packages
httpster
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2023-01-06

Affected packages

• npm httpster: < 1.1.0 → fixed in 1.1.0

Description

A vulnerability classified as critical was found in SimbCo httpster. This vulnerability affects the function fs.realpathSync of the file src/server.coffee. The manipulation leads to path traversal. The exploit has been disclosed to the public and may be used. The name of the patch is d3055b3e30b40b65d30c5a06d6e053dffa7f35d0. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216748.

Related

Alias · CVE (1)

  • CVE-2020-36629 A vulnerability classified as critical was found in SimbCo httpster. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References