Description

Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the DELETE function in api/files endpoint.

Remediation

References

https://devhub.checkmarx.com/cve-details/CVE-2023-46496/

https://devhub.checkmarx.com/cve-details/Cx943be66a-54cc/

Related Vulnerabilities

CVE-2021-21412 Vulnerability in npm package egf

CVE-2018-8028 Vulnerability in maven package org.apache.sentry:sentry-binding-hive

CVE-2020-15231 Vulnerability in maven package org.mapfish.print:print-standalone

CVE-2022-24891 Vulnerability in maven package org.owasp.esapi:esapi

CVE-2021-27191 Vulnerability in npm package get-ip-range

Severity

Critical

Classification

CWE-22 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

Tags

Third Party Advisory Not Applicable