CVE-2017-14849

Опубликовано: 28 сент. 2017

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Высокий

Описание

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.

Ссылки

http://www.securityfocus.com/bid/101056
Third Party Advisory
VDB Entry
https://nodejs.org/en/blog/vulnerability/september-2017-path-validation/
Patch
Vendor Advisory
https://twitter.com/nodejs/status/913131152868876288
Patch
Third Party Advisory
http://www.securityfocus.com/bid/101056
Third Party Advisory
VDB Entry
https://nodejs.org/en/blog/vulnerability/september-2017-path-validation/
Patch
Vendor Advisory
https://twitter.com/nodejs/status/913131152868876288
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:nodejs:node.js:8.5.0:*:*:*:*:*:*:*

EPSS

Процентиль: 99%

0.88735

Высокий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-22

Связанные уязвимости

CVE-2017-14849

CVSS3: 7.5

ubuntu

около 8 лет назад

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.

CVE-2017-14849

CVSS3: 7.5

debian

около 8 лет назад

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintende ...

GHSA-c5w2-4jcq-rvf5

CVSS3: 7.5

github

больше 3 лет назад

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.

SUSE-SU-2019:14246-1

suse-cvrf

почти 6 лет назад

Security update for Mozilla Firefox

EPSS

Процентиль: 99%

0.88735

Высокий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-22