GitHub Advisoryadvisory · npm

GHSA-xg75-3277-gvvj Directory Traversal in serve

HIGH Published 2019-03-25 Modified 2021-09-21 Official page ↗
Aliases
CVE-2019-5417
Ecosystem
npm
Packages
serve
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2020-06-16

Affected packages

• npm serve: < 7.1.3 → fixed in 7.1.3

Description

Versions of `serve` before 7.1.3 are vulnerable to Directory Traversal. File paths are not sanitized leading to unauthorized access of system files. Recommendation Upgrade to version 7.1.3 or later

Related

Alias · CVE (1)

  • CVE-2019-5417 A path traversal vulnerability in serve npm package version 7.0.1 allows the attackers to read content of arbitrary files on the remote… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References