Description

serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded.

Remediation

References

https://hackerone.com/reports/308721

Related Vulnerabilities

CVE-2023-49382 Vulnerability in maven package com.jfinal:jfinal

CVE-2022-36902 Vulnerability in maven package com.moded.extendedchoiceparameter:dynamic_extended_choice_parameter

CVE-2022-25167 Vulnerability in maven package org.apache.flume.flume-ng-sources:flume-jms-source

CVE-2020-8441 Vulnerability in maven package org.jyaml:jyaml

CVE-2021-32854 Vulnerability in maven package org.webjars:textangular

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Exploit Patch Third Party Advisory NVD-CWE-noinfo