Description

Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the mkdirSync function in the folderCreate/createFolder.js endpoint.

Remediation

References

https://devhub.checkmarx.com/cve-details/CVE-2023-46497/

https://devhub.checkmarx.com/cve-details/Cx16846793-56b6/

Related Vulnerabilities

CVE-2017-8046 Vulnerability in maven package org.springframework.data:spring-data-rest-webmvc

CVE-2022-21164 Vulnerability in npm package node-lmdb

CVE-2020-2142 Vulnerability in maven package org.jenkins-ci.plugins:p4

CVE-2019-16763 Vulnerability in maven package org.webjars.npm:pannellum

CVE-2017-16198 Vulnerability in npm package ritp

Severity

Medium

Classification

CWE-22 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Tags

Third Party Advisory Not Applicable