Path Traversal Vulnerability in crud-file-server Node Module by Omphalos
CVE-2018-3733

7.5HIGH

Key Information:

Vendor

Hackerone

Status
Crud-file-server Node Module
Vendor
CVE Published:
29 May 2018

What is CVE-2018-3733?

The crud-file-server Node module prior to version 0.9.0 is susceptible to a Path Traversal vulnerability, allowing attackers to bypass file path restrictions. This flaw arises from improper validation of URL input, which can enable an unauthorized user to read arbitrary files on the server. By exploiting this vulnerability, potential attackers could gain access to sensitive information stored in accessible file paths, leading to significant security risks.

Affected Version(s)

crud-file-server node module Versions before 0.9.0

References

https://hackerone.com/reports/310690
x_refsource_MISC
https://github.com/omphalos/crud-file-server/commit/4fc3b...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2018-3733 : Path Traversal Vulnerability in crud-file-server Node Module by Omphalos