What is GHSA-2mp5-m968-gwr2?

GHSA-2mp5-m968-gwr2 is a security advisory published by GitHub Security Advisories with Medium severity. Path Traversal in http-file-server

Which CVE IDs does GHSA-2mp5-m968-gwr2 cover?

GHSA-2mp5-m968-gwr2 covers the following CVE IDs: CVE-2019-5447. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2mp5-m968-gwr2?

GHSA-2mp5-m968-gwr2 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-2mp5-m968-gwr2?

GHSA-2mp5-m968-gwr2 affects 1 product, including: npm/http-file-server:\u003c 0.2.6.

GHSA-2mp5-m968-gwr2MediumCVSS 5.3

Path Traversal in http-file-server

Vendor

GitHub Security Advisories

Published

July 16, 2019

Last Modified

February 3, 2023

🔗 CVE IDs covered (1)

CVE-2019-5447 →

📋 Description

All versions of http-file-server are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.

Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

🎯 Affected products1

npm/http-file-server:< 0.2.6

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2019-5447
https://hackerone.com/reports/570133
https://www.npmjs.com/advisories/1077
https://github.com/advisories/GHSA-2mp5-m968-gwr2