CVE-2018-3712

serve node module before 6.4.9 suffers from a Path Traversal vulnerability due to not handling %2e (.) and %2f (/) and allowing them in paths, which allows a malicious user to view the contents of any directory with known path.
References
Link Resource
https://github.com/zeit/serve/pull/316 Vendor Advisory
https://hackerone.com/reports/307666 Exploit Technical Description
https://github.com/zeit/serve/pull/316 Vendor Advisory
https://hackerone.com/reports/307666 Exploit Technical Description
Configurations

Configuration 1 (hide)

cpe:2.3:a:zeit:serve:*:*:*:*:*:node.js:*:*

History

21 Nov 2024, 04:05

Type Values Removed Values Added
References () https://github.com/zeit/serve/pull/316 - Vendor Advisory () https://github.com/zeit/serve/pull/316 - Vendor Advisory
References () https://hackerone.com/reports/307666 - Exploit, Technical Description () https://hackerone.com/reports/307666 - Exploit, Technical Description

Information

Published : 2018-06-07 02:29

Updated : 2024-11-21 04:05


NVD link : CVE-2018-3712

Mitre link : CVE-2018-3712

CVE.ORG link : CVE-2018-3712


JSON object : View

Products Affected

zeit

  • serve
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')