Path Traversal Vulnerability in Serve Node Module by Zeit
CVE-2018-3712

6.5MEDIUM

Key Information:

Vendor

Hackerone

Status
Serve Node Module
Vendor
CVE Published:
7 June 2018

What is CVE-2018-3712?

The Serve Node Module, prior to version 6.4.9, is susceptible to a Path Traversal vulnerability. This flaw arises from an improper handling of special characters such as %2e (dot) and %2f (forward slash) in file paths. This oversight allows malicious users to traverse directories and access sensitive files on the server, posing significant security risks. It is crucial for users of the affected module to upgrade to the latest version to mitigate this vulnerability.

Affected Version(s)

serve node module Versions before 6.4.9

References

https://github.com/zeit/serve/pull/316
x_refsource_MISC
https://hackerone.com/reports/307666
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.