Description

Node.js version 8.5.0 included a change which caused a security vulnerability in the checks on paths made by some community modules. As a result, an attacker may be able to access file system paths other than those intended.

Version 8.5.0 of Node.js is vulnerable. 4.x and 6.x versions are NOT vulnerable.

Remediation

Upgrade to the latest version of Node.js. This vulnerability was fixed with the patch from September 2017.

References

Path validation vulnerability, September 2017

Related Vulnerabilities

SugarCRM Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2019-17311)

Wordpress Plugin Backup Migration Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2023-6972)

WordPress 6.0.x Multiple Vulnerabilities (6.0 - 6.0.3)

WordPress Plugin WP Cost Estimation & Payment Forms Builder Directory Traversal (9.659)

WordPress Plugin GD bbPress Attachments Multiple Vulnerabilities (2.2)

Severity

High

Classification

CVE-2017-14849 CWE-22 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Directory Traversal