GHSA-g4xp-36c3-f7mr

Source

https://github.com/advisories/GHSA-g4xp-36c3-f7mr

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/08/GHSA-g4xp-36c3-f7mr/GHSA-g4xp-36c3-f7mr.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-g4xp-36c3-f7mr

Aliases

CVE-2014-10068

Published

2020-08-31T22:47:41Z

Modified

2023-11-08T03:57:33Z

Summary

Hidden Directories Always Served in inert

Details

Versions 1.1.1 and earlier of inert are vulnerable to an information leakage vulnerability which causes files in hidden directories to be served, even when showHidden is false.

The inert directory handler always allows files in hidden directories to be served, even when showHidden is false.

Recommendation

Update to version >= 1.1.1.

Database specific

{
    "cwe_ids":  [
        "CWE-22"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-08-31T18:07:50Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

npm / inert

Package

Name: inert; View open source insights on deps.dev
Purl: pkg:npm/inert

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.1.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/08/GHSA-g4xp-36c3-f7mr/GHSA-g4xp-36c3-f7mr.json"