GHSA-46hv-7769-j7rxMediumCVSS 5.3

Unauthorized File Access in harp

Published
June 13, 2019
Last Modified
September 7, 2023

🔗 CVE IDs covered (1)

CVE-2019-5437 →

📋 Description

Affected versions of harp are vulnerable to Unauthorized File Access. The package states that it ignores files and directories with names that start with an underscore, such as _secret-folder. If the underscore character is URL encoded the server delivers the file.

Recommendation

Upgrade to version 0.40.2 or later.

🎯 Affected products1

  • npm/harp:< 0.40.2

🔗 References (5)