CVE-2018-3724

Опубликовано: 07 июн. 2018

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

general-file-server node module suffers from a Path Traversal vulnerability due to lack of validation of currpath, which allows a malicious user to read content of any file with known path.

Ссылки

https://hackerone.com/reports/310943
Exploit
Third Party Advisory
https://hackerone.com/reports/310943
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:general-file-server_project:general-file-server:1.0.0:*:*:*:*:node.js:*:*

cpe:2.3:a:general-file-server_project:general-file-server:1.1.2:*:*:*:*:node.js:*:*

cpe:2.3:a:general-file-server_project:general-file-server:1.1.3:*:*:*:*:node.js:*:*

cpe:2.3:a:general-file-server_project:general-file-server:1.1.4:*:*:*:*:node.js:*:*

cpe:2.3:a:general-file-server_project:general-file-server:1.1.5:*:*:*:*:node.js:*:*

cpe:2.3:a:general-file-server_project:general-file-server:1.1.6:*:*:*:*:node.js:*:*

cpe:2.3:a:general-file-server_project:general-file-server:1.1.7:*:*:*:*:node.js:*:*

cpe:2.3:a:general-file-server_project:general-file-server:1.1.8:*:*:*:*:node.js:*:*

EPSS

Процентиль: 58%

0.00362

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-22

Связанные уязвимости

GHSA-wv2f-3rxv-jqhp