CVE-2022-25848

This affects all versions of package static-dev-server. This is because when paths from users to the root directory are joined, the assets for the path accessed are relative to that of the root directory.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://gist.github.com/lirantal/5550bcd0bdf92c1b56fbb20e141fe5bd	Exploit Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-STATICDEVSERVER-3149917	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:static-dev-server_project:static-dev-server:1.0.0:*:*:*:*:node.js:*:*

History

No history.

Information

Published : 2022-11-29 17:15

Updated : 2024-02-28 19:51

NVD link : CVE-2022-25848

Mitre link : CVE-2022-25848

CVE.ORG link : CVE-2022-25848

JSON object : View

Products Affected

static-dev-server_project

static-dev-server

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2022-25848", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "report@snyk.io", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2022-11-29T17:15:11.123", "references": [{"url": "https://gist.github.com/lirantal/5550bcd0bdf92c1b56fbb20e141fe5bd", "tags": ["Exploit", "Third Party Advisory"], "source": "report@snyk.io"}, {"url": "https://security.snyk.io/vuln/SNYK-JS-STATICDEVSERVER-3149917", "tags": ["Exploit", "Third Party Advisory"], "source": "report@snyk.io"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "This affects all versions of package static-dev-server. This is because when paths from users to the root directory are joined, the assets for the path accessed are relative to that of the root directory."}, {"lang": "es", "value": "Esto afecta a todas las versiones del paquete static-dev-server. Esto se debe a que cuando se unen las rutas de los usuarios al directorio ra\u00edz, los activos de la ruta a la que se accede son relativos a los del directorio ra\u00edz."}], "lastModified": "2022-12-01T20:56:52.047", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:static-dev-server_project:static-dev-server:1.0.0:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "55B95FC2-FADB-47C7-996A-8F4A682E9544"}], "operator": "OR"}]}], "sourceIdentifier": "report@snyk.io"}