Description

iter-http is a server for static files. iter-http is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.

Remediation

References

https://nodesecurity.io/advisories/343

https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/iter-http

Related Vulnerabilities

CVE-2021-29443 Vulnerability in npm package jose

CVE-2021-43785 Vulnerability in npm package @joeattardi/emoji-button

CVE-2021-23353 Vulnerability in maven package org.webjars:jspdf

CVE-2021-32640 Vulnerability in npm package ws

CVE-2022-22138 Vulnerability in npm package fast-string-search

Severity

High

Classification

CWE-22 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Exploit Third Party Advisory