vercel/serve allows access to restricted files if filename is URL encoded. · CVE-2018-3718 · GitHub Advisory Database · GitHub

vercel/serve allows access to restricted files if filename is URL encoded.

Moderate severity GitHub Reviewed Published Aug 9, 2021 to the GitHub Advisory Database • Updated Sep 12, 2023

Package

serve (npm)

Affected versions

< 6.5.2

Patched versions

6.5.2

Description

serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded.

References

Published by the National Vulnerability Database

Jun 7, 2018

Reviewed Aug 9, 2021

Published to the GitHub Advisory Database Aug 9, 2021

Last updated Sep 12, 2023

Severity

Moderate

5.3

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N