Description

Cross-site scripting (XSS) vulnerability in the serve-index package before 1.6.3 for Node.js allows remote attackers to inject arbitrary web script or HTML via a crafted file or directory name.

Remediation

References

http://www.openwall.com/lists/oss-security/2016/04/20/11

http://www.securityfocus.com/bid/96392

https://nodesecurity.io/advisories/34

Related Vulnerabilities

CVE-2021-39184 Vulnerability in npm package electron

CVE-2023-22621 Vulnerability in npm package @strapi/plugin-users-permissions

CVE-2022-25857 Vulnerability in maven package org.yaml:snakeyaml

CVE-2023-30520 Vulnerability in maven package org.jenkins-ci.plugins:quayio-trigger

CVE-2018-25031 Vulnerability in npm package swagger-ui

Severity

High

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Mailing List Third Party Advisory Broken Link Patch Vendor Advisory