CVE-2017-16194

Опубликовано: 07 июн. 2018

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

picard is a micro framework. picard is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.

Ссылки

https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/picard
Exploit
Third Party Advisory
https://nodesecurity.io/advisories/436
Third Party Advisory
https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/picard
Exploit
Third Party Advisory
https://nodesecurity.io/advisories/436
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:picard_project:picard:0.3.0:*:*:*:*:node.js:*:*

cpe:2.3:a:picard_project:picard:0.3.1:*:*:*:*:node.js:*:*

EPSS

Процентиль: 67%

0.00533

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-22

Связанные уязвимости

GHSA-x5x2-mfc7-r22f

github

больше 7 лет назад

Directory Traversal in picard