Описание
A Path Traversal issue was discovered in the socket.io-file package through 2.0.31 for Node.js. The socket.io-file::createFile message uses path.join with ../ in the name option, and the uploadDir and rename options determine the path.
Ссылки
- Third Party Advisory
- Third Party Advisory
- ExploitThird Party Advisory
- ProductThird Party Advisory
- Third Party Advisory
- Third Party Advisory
- ExploitThird Party Advisory
- ProductThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 2.0.31 (включая)
cpe:2.3:a:socket.io-file_project:socket.io-file:*:*:*:*:*:node.js:*:*
EPSS
Процентиль: 64%
0.0046
Низкий
7.5 High
CVSS3
5 Medium
CVSS2
Дефекты
CWE-22
Связанные уязвимости
EPSS
Процентиль: 64%
0.0046
Низкий
7.5 High
CVSS3
5 Medium
CVSS2
Дефекты
CWE-22