Description

crud-file-server node module before 0.9.0 suffers from a Path Traversal vulnerability due to incorrect validation of url, which allows a malicious user to read content of any file with known path.

Remediation

References

https://hackerone.com/reports/310690

https://github.com/omphalos/crud-file-server/commit/4fc3b404f718abb789f4ce4272c39c7a138c7a82

Related Vulnerabilities

CVE-2023-32261 Vulnerability in maven package org.jenkins-ci.plugins:dimensionsscm

CVE-2021-25949 Vulnerability in npm package set-getter

CVE-2020-8913 Vulnerability in maven package com.google.android.play:core

CVE-2020-28477 Vulnerability in npm package immer

CVE-2023-26104 Vulnerability in npm package lite-web-server

Severity

High

Classification

CWE-22 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Exploit Issue Tracking Third Party Advisory Patch