Description

A bug in handling the ignore files and directories feature in serve 6.5.3 allows an attacker to read a file or list the directory that the victim has not allowed access to.

Remediation

References

https://hackerone.com/reports/330724

Related Vulnerabilities

CVE-2022-36076 Vulnerability in npm package nodebb

CVE-2021-27582 Vulnerability in maven package org.mitre:openid-connect-server

CVE-2021-3822 Vulnerability in npm package jsoneditor

CVE-2023-25826 Vulnerability in maven package net.opentsdb:opentsdb

CVE-2019-15903 Vulnerability in npm package dbus

Severity

High

Classification

CWE-269 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Exploit Third Party Advisory