Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in an unspecified path.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to
    read arbitrary files via a %2e%2e (encoded dot dot) in an unspecified path. (CVE-2014-3744)

The remote application server is affected by potential information disclosure related to a remote directory traversal vulnerability. The vendor has released EBF files (patches) for the affected versions.

ID	Name	Product	Family	Severity
411352	SCA: security update for st (GHSA-69rr-wvh9-6c4q)	Tenable Cloud Security	SCA Checks	high
411352	SCA: security update for st (GHSA-69rr-wvh9-6c4q)	Tenable Self-Hosted Container Security	SCA Checks	high
6902	EAServer <= 6.3.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium

Detections

Analytics

CVE-2014-3744

high

Tenable Plugins

high

high

medium