Description

`f2e-server` 1.12.11 and earlier is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. This is compounded by `f2e-server` requiring elevated privileges to run.

Remediation

References

https://nodesecurity.io/advisories/346

https://github.com/shy2850/node-server/pull/12/files

https://github.com/shy2850/node-server/issues/10

Related Vulnerabilities

CVE-2020-6858 Vulnerability in maven package com.hotels.styx:styx-components

CVE-2019-10311 Vulnerability in maven package org.jenkins-ci.plugins:ansible-tower

CVE-2021-3805 Vulnerability in npm package object-path

CVE-2023-31581 Vulnerability in maven package com.usthe.sureness:sureness-core

CVE-2019-3778 Vulnerability in maven package org.springframework.security.oauth:spring-security-oauth2

Severity

High

Classification

CWE-22 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Third Party Advisory Patch Exploit Issue Tracking