GitHub Advisoryadvisory · npm
GHSA-vwr2-wj63-86gr Path Traversal in simplehttpserver
MEDIUM
Official page ↗
- Aliases
- CVE-2018-16478
- Ecosystem
- npm
- Packages
- simplehttpserver
- Severity
- Moderate
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-22
- Reviewed
- 2020-06-16
Affected packages
• npm simplehttpserver: <= 0.3.0 (no fix yet)
Description
All versions of `simplehttpserver` are vulnerable to Path Traversal.
This vulnerability allows an attacker to access files outside the webroot since it allows symlink navigation in the URL.
Recommendation
No fix is currently available. Do not use `simplehttpserver` in production or consider using an alternative module until a fix is made available.
Related
Alias · CVE (1)
- CVE-2018-16478 A Path Traversal in simplehttpserver versions <=0.2.1 allows to list any file in another folder of web root. vulnerability
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-16478 advisory
- https://hackerone.com/reports/403703 web
- https://github.com/advisories/GHSA-vwr2-wj63-86gr advisory
- https://github.com/nodejs/security-wg/blob/master/vuln/npm/484.json web
- https://github.com/tikonen/blog/tree/master/simplehttpserver package
- https://www.npmjs.com/advisories/744 web