What is GHSA-2j5x-56p6-hj6x?

GHSA-2j5x-56p6-hj6x is a security advisory published by GitHub Security Advisories with Medium severity. Path Traversal in statichttpserver

Which CVE IDs does GHSA-2j5x-56p6-hj6x cover?

GHSA-2j5x-56p6-hj6x covers the following CVE IDs: CVE-2019-5480. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2j5x-56p6-hj6x?

GHSA-2j5x-56p6-hj6x has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-2j5x-56p6-hj6x?

GHSA-2j5x-56p6-hj6x affects 1 product, including: npm/statichttpserver:\u003c= 0.9.7.

GHSA-2j5x-56p6-hj6xMediumCVSS 5.3

Path Traversal in statichttpserver

Vendor

GitHub Security Advisories

Published

September 4, 2019

Last Modified

September 12, 2023

🔗 CVE IDs covered (1)

CVE-2019-5480 →

📋 Description

All versions of statichttpserver are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.

Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

🎯 Affected products1

npm/statichttpserver:<= 0.9.7

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2019-5480
https://hackerone.com/reports/570035
https://www.npmjs.com/advisories/1143
https://github.com/advisories/GHSA-2j5x-56p6-hj6x