CVE-2017-16164

Опубликовано: 07 июн. 2018

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

desafio is a simple web server. desafio is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url, but is limited to accessing only .html files.

Ссылки

https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/desafio
Exploit
Third Party Advisory
Tool Signature
https://nodesecurity.io/advisories/397
Third Party Advisory
Tool Signature
https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/desafio
Exploit
Third Party Advisory
Tool Signature
https://nodesecurity.io/advisories/397
Third Party Advisory
Tool Signature

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:desafio_project:desafio:1.0.0:*:*:*:*:node.js:*:*

cpe:2.3:a:desafio_project:desafio:1.1.0:*:*:*:*:node.js:*:*

EPSS

Процентиль: 67%

0.00533

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-22

Связанные уязвимости

GHSA-f499-jv47-9wxf

github

больше 7 лет назад

Directory Traversal in desafio