What is GHSA-333x-9vgq-v2j4?

GHSA-333x-9vgq-v2j4 is a security advisory published by GitHub Security Advisories with High severity. Directory Traversal in geddy

Which CVE IDs does GHSA-333x-9vgq-v2j4 cover?

GHSA-333x-9vgq-v2j4 covers the following CVE IDs: CVE-2015-5688. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-333x-9vgq-v2j4?

GHSA-333x-9vgq-v2j4 affects 1 product, including: npm/geddy:\u003c 13.0.8.

GHSA-333x-9vgq-v2j4High

Directory Traversal in geddy

Vendor

GitHub Security Advisories

Published

October 24, 2017

Last Modified

January 9, 2023

🔗 CVE IDs covered (1)

CVE-2015-5688 →

📋 Description

Versions 13.0.8 and earlier of geddy are vulnerable to a directory traversal attack via URI encoded attack vectors.

Proof of Concept

http://localhost:4000/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd

Recommendation

Update geddy to version >= 13.0.8

🎯 Affected products1

npm/geddy:< 13.0.8

🔗 References (7)

https://nvd.nist.gov/vuln/detail/CVE-2015-5688
https://github.com/geddy/geddy/issues/697
https://github.com/geddy/geddy/pull/699
https://github.com/advisories/GHSA-333x-9vgq-v2j4
https://www.npmjs.com/advisories/10
https://github.com/geddy/geddy/commit/2de63b68b3aa6c08848f261ace550a37959ef231
https://github.com/geddy/geddy/releases/tag/v13.0.8