Detections
Analytics

Node.js 8.5.x < 8.6.0 Path Traversal

high Web App Scanning Plugin ID 112717

Language:

Synopsis

Node.js 8.5.x < 8.6.0 Path Traversal

Description

Node.js version 8.5.0 included a change to ".." handling which caused a security vulnerability in the checks on paths made by some community modules.

As a result, an attacker may be able to access file system paths other than those intended.

This issue is fixed in version 8.6.0.

Solution

Upgrade NodeJS to at least version 8.6.0 or later

See Also

https://nodejs.org/en/blog/vulnerability/september-2017-path-validation/

Plugin Details

Severity: High

ID: 112717

Type: remote

Published: 3/11/2021

Updated: 9/7/2021

Scan Template: api, basic, full, pci, scan

Risk Information

VPR

Risk Factor: Medium

Score: 5.1

CVSS v2

Risk Factor: Medium

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2017-14849

CVSS v3

Risk Factor: High

Base Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS Score Source: CVE-2017-14849

Vulnerability Information

CPE: cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 9/27/2017

Reference Information

CVE: CVE-2017-14849

BID: 101056