Description

Cross-site scripting (XSS) vulnerability in the serve-index package before 1.6.3 for Node.js allows remote attackers to inject arbitrary web script or HTML via a crafted file or directory name.

Remediation

References

https://nodesecurity.io/advisories/34

http://www.openwall.com/lists/oss-security/2016/04/20/11

http://www.securityfocus.com/bid/96392

Related Vulnerabilities

CVE-2018-11786 Vulnerability in maven package org.apache.karaf.shell:org.apache.karaf.shell.core

CVE-2021-45457 Vulnerability in maven package org.apache.kylin:kylin-server

CVE-2011-1183 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core

CVE-2022-29167 Vulnerability in maven package org.webjars.npm:hawk

CVE-2018-15531 Vulnerability in maven package net.bull.javamelody:javamelody-core

Severity

High

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Patch Vendor Advisory Mailing List Third Party Advisory Broken Link