Vulnerability Description
elding is a simple web server. elding is vulnerable to a directory traversal issue, allowing an attacker to access the filesystem by placing "../" in the url. The files accessible, however, are limited to files with a file extension. Sending a GET request to /../../../etc/passwd, for example, will return a 404 on etc/passwd/index.js.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Elding Project | Elding | 1.0.0 |
Related Weaknesses (CWE)
References
- https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/eldingExploitThird Party Advisory
- https://nodesecurity.io/advisories/415Third Party Advisory
- https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/eldingExploitThird Party Advisory
- https://nodesecurity.io/advisories/415Third Party Advisory
FAQ
What is CVE-2017-16222?
CVE-2017-16222 is a vulnerability with a CVSS score of 5.3 (MEDIUM). elding is a simple web server. elding is vulnerable to a directory traversal issue, allowing an attacker to access the filesystem by placing "../" in the url. The files accessible, however, are limite...
How severe is CVE-2017-16222?
CVE-2017-16222 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-16222?
Check the references section above for vendor advisories and patch information. Affected products include: Elding Project Elding.