Description

`gomeplus-h5-proxy` is vulnerable to a directory traversal issue, allowing attackers to access any file in the system by placing '../' in the URL.

Remediation

References

https://nodesecurity.io/advisories/350

https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/gomeplus-h5-proxy

Related Vulnerabilities

CVE-2023-45282 Vulnerability in npm package openmct

CVE-2022-25167 Vulnerability in maven package org.apache.flume:flume-parent

CVE-2022-24725 Vulnerability in npm package shescape

CVE-2018-3745 Vulnerability in maven package org.webjars.npm:atob

CVE-2019-19771 Vulnerability in npm package bp66

Severity

High

Classification

CWE-22 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Third Party Advisory Exploit