GHSA-48gc-5j93-5cfq

Source

https://github.com/advisories/GHSA-48gc-5j93-5cfq

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-48gc-5j93-5cfq/GHSA-48gc-5j93-5cfq.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-48gc-5j93-5cfq

Published

2020-09-11T21:15:54Z

Modified

2020-08-31T18:42:15Z

Summary

Path Traversal in serve

Details

Versions of serve prior to 10.1.2 are vulnerable to Path Traversal. Explicitly ignored folders can be accessed through relative paths, which allows attackers to access hidden folders and files.

Recommendation

Upgrade to version 10.1.2 or later.

Database specific

{
    "cwe_ids": [
        "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:42:15Z",
    "nvd_published_at": null,
    "severity": "HIGH"
}

References

Affected packages

npm / serve

Package

Name: serve; View open source insights on deps.dev
Purl: pkg:npm/serve

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

10.1.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-48gc-5j93-5cfq/GHSA-48gc-5j93-5cfq.json"