CVE-2019-5458

Опубликовано: 30 июл. 2019

Источник: nvd

CVSS3: 5.4

CVSS2: 3.5

EPSS Низкий

Описание

Cross-site scripting (XSS) vulnerability in http-file-server (all versions) allows an attacker with access to the server file system to execute arbitrary JavaScript code in victim's browser.

Ссылки

https://hackerone.com/reports/570563
Exploit
Third Party Advisory
https://hackerone.com/reports/570563
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:http-file-server_project:http-file-server:0.1.0:*:*:*:*:node.js:*:*

cpe:2.3:a:http-file-server_project:http-file-server:0.2.0:*:*:*:*:node.js:*:*

cpe:2.3:a:http-file-server_project:http-file-server:0.2.1:*:*:*:*:node.js:*:*

cpe:2.3:a:http-file-server_project:http-file-server:0.2.2:*:*:*:*:node.js:*:*

cpe:2.3:a:http-file-server_project:http-file-server:0.2.3:*:*:*:*:node.js:*:*

cpe:2.3:a:http-file-server_project:http-file-server:0.2.4:*:*:*:*:node.js:*:*

cpe:2.3:a:http-file-server_project:http-file-server:0.2.5:*:*:*:*:node.js:*:*

cpe:2.3:a:http-file-server_project:http-file-server:0.2.6:*:*:*:*:node.js:*:*

EPSS

Процентиль: 34%

0.0014

Низкий

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-7j93-2h6r-hm49