pillarjs/send · Security
Root Path Disclosure in send
- GHSA ID
- GHSA-jgqf-hwc5-hh37
- CVE ID
- CVE-2015-8859
- Severity
- medium
- Published
- Updated
- CVSS
- 5.3 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- CVSS v3
- 5.3 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Description
Versions of send prior to 0.11.2 are affected by an information leakage vulnerability which may allow an attacker to enumerate paths on the server filesystem.
Recommendation
Update to version 0.11.1 or later.
CWEs
- CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
References
- https://nvd.nist.gov/vuln/detail/CVE-2015-8859 ↗
- https://github.com/pillarjs/send/pull/70 ↗
- https://github.com/expressjs/serve-static/blob/master/HISTORY.md#181--2015-01-20 ↗
- http://www.openwall.com/lists/oss-security/2016/04/20/11 ↗
- https://github.com/pillarjs/send/commit/98a5b89982b38e79db684177cf94730ce7fc7aed ↗
- https://web.archive.org/web/20200227192016/https://www.securityfocus.com/bid/96435/ ↗
- https://github.com/advisories/GHSA-jgqf-hwc5-hh37 ↗