Servst vulnerable to Path Traversal · CVE-2022-25936 · GitHub Advisory Database · GitHub

Servst vulnerable to Path Traversal

High severity GitHub Reviewed Published Jan 30, 2023 to the GitHub Advisory Database • Updated Feb 15, 2023

Package

servst (npm)

Affected versions

< 2.0.3

Patched versions

2.0.3

Description

Versions of the package servst before 2.0.3 are vulnerable to Directory Traversal due to improper sanitization of the filePath variable.

References

Published by the National Vulnerability Database

Jan 30, 2023

Published to the GitHub Advisory Database Jan 30, 2023

Reviewed Feb 1, 2023

Last updated Feb 15, 2023

Severity

High

7.5

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N