GHSA-jgqf-hwc5-hh37MediumCVSS 5.3
Root Path Disclosure in send
🔗 CVE IDs covered (1)
📋 Description
Versions of send prior to 0.11.2 are affected by an information leakage vulnerability which may allow an attacker to enumerate paths on the server filesystem.
Recommendation
Update to version 0.11.1 or later.
🎯 Affected products1
- npm/send:< 0.11.1
🔗 References (7)
- https://nvd.nist.gov/vuln/detail/CVE-2015-8859
- https://github.com/pillarjs/send/pull/70
- https://github.com/expressjs/serve-static/blob/master/HISTORY.md#181--2015-01-20
- http://www.openwall.com/lists/oss-security/2016/04/20/11
- https://github.com/pillarjs/send/commit/98a5b89982b38e79db684177cf94730ce7fc7aed
- https://web.archive.org/web/20200227192016/https://www.securityfocus.com/bid/96435/
- https://github.com/advisories/GHSA-jgqf-hwc5-hh37