What is GHSA-vwr2-wj63-86gr?

GHSA-vwr2-wj63-86gr is a security advisory published by GitHub Security Advisories with Medium severity. Path Traversal in simplehttpserver

Which CVE IDs does GHSA-vwr2-wj63-86gr cover?

GHSA-vwr2-wj63-86gr covers the following CVE IDs: CVE-2018-16478. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vwr2-wj63-86gr?

GHSA-vwr2-wj63-86gr has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-vwr2-wj63-86gr?

GHSA-vwr2-wj63-86gr affects 1 product, including: npm/simplehttpserver:\u003c= 0.3.0.

GHSA-vwr2-wj63-86grMediumCVSS 5.3

Path Traversal in simplehttpserver

Vendor

GitHub Security Advisories

Published

December 6, 2018

Last Modified

September 12, 2023

🔗 CVE IDs covered (1)

CVE-2018-16478 →

📋 Description

All versions of simplehttpserver are vulnerable to Path Traversal.

This vulnerability allows an attacker to access files outside the webroot since it allows symlink navigation in the URL.

Recommendation

No fix is currently available. Do not use simplehttpserver in production or consider using an alternative module until a fix is made available.

🎯 Affected products1

npm/simplehttpserver:<= 0.3.0

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2018-16478
https://hackerone.com/reports/403703
https://github.com/advisories/GHSA-vwr2-wj63-86gr
https://github.com/nodejs/security-wg/blob/master/vuln/npm/484.json
https://www.npmjs.com/advisories/744