What is GHSA-g4xp-36c3-f7mr?

GHSA-g4xp-36c3-f7mr is a security advisory published by GitHub Security Advisories with Medium severity. Hidden Directories Always Served in inert

Which CVE IDs does GHSA-g4xp-36c3-f7mr cover?

GHSA-g4xp-36c3-f7mr covers the following CVE IDs: CVE-2014-10068. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-g4xp-36c3-f7mr?

GHSA-g4xp-36c3-f7mr affects 1 product, including: npm/inert:\u003c 1.1.1.

GHSA-g4xp-36c3-f7mrMedium

Hidden Directories Always Served in inert

Vendor

GitHub Security Advisories

Published

August 31, 2020

Last Modified

January 9, 2023

🔗 CVE IDs covered (1)

CVE-2014-10068 →

📋 Description

Versions 1.1.1 and earlier of inert are vulnerable to an information leakage vulnerability which causes files in hidden directories to be served, even when showHidden is false.

The inert directory handler always allows files in hidden directories to be served, even when showHidden is false.

Recommendation

Update to version >= 1.1.1.

🎯 Affected products1

npm/inert:< 1.1.1

🔗 References (5)

https://github.com/hapijs/inert/pull/15
https://github.com/hapijs/inert/commit/e8f99f94da4cb08e8032eda984761c3f111e3e82
https://www.npmjs.com/advisories/14
https://nvd.nist.gov/vuln/detail/CVE-2014-10068
https://github.com/advisories/GHSA-g4xp-36c3-f7mr