MEDIUM6.5

GHSA-899g-6q6w-7v94

m-server Vulnerable to Directory Traversal

Quick fix

GHSA-899g-6q6w-7v94 — m-server: upgrade to the fixed version with the command below.

npm install m-server@1.4.1

Details

Path Traversal vulnerability in module m-server <1.4.1 allows malicious user to access unauthorized content of any file in the directory tree e.g. /etc/passwd by appending slashes to the URL request.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/m-server

Introduced in: 0Fixed in: 1.4.1

Fixnpm install m-server@1.4.1

References

https://nvd.nist.gov/vuln/detail/CVE-2018-16485[ADVISORY]
https://hackerone.com/reports/319795[WEB]
https://github.com/advisories/GHSA-899g-6q6w-7v94[ADVISORY]