CVE-2022-25931

All versions of package easy-static-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed to the req.url user input that is passed to the server code.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://gist.github.com/lirantal/fdfbe26561788c8194a54bf6d31772c9	Exploit Third Party Advisory
https://github.com/cunjieliu/easyServer/blob/master/index.js%23L27	Broken Link Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-EASYSTATICSERVER-3153539	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:easy-static-server_project:easy-static-server:*:*:*:*:*:node.js:*:*

History

No history.

Information

Published : 2022-12-20 05:15

Updated : 2022-12-29 18:45

NVD link : CVE-2022-25931

Mitre link : CVE-2022-25931

CVE.ORG link : CVE-2022-25931

JSON object : View

Products Affected

easy-static-server_project

easy-static-server

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2022-25931", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "report@snyk.io", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2022-12-20T05:15:11.587", "references": [{"url": "https://gist.github.com/lirantal/fdfbe26561788c8194a54bf6d31772c9", "tags": ["Exploit", "Third Party Advisory"], "source": "report@snyk.io"}, {"url": "https://github.com/cunjieliu/easyServer/blob/master/index.js%23L27", "tags": ["Broken Link", "Third Party Advisory"], "source": "report@snyk.io"}, {"url": "https://security.snyk.io/vuln/SNYK-JS-EASYSTATICSERVER-3153539", "tags": ["Exploit", "Third Party Advisory"], "source": "report@snyk.io"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "All versions of package easy-static-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed to the req.url user input that is passed to the server code."}, {"lang": "es", "value": "Todas las versiones del paquete easy-static-server son vulnerables a Directory Traversal debido a la falta de sanitizaci\u00f3n de entrada y al uso de entornos sandbox para la entrada del usuario req.url que se pasa al c\u00f3digo del servidor."}], "lastModified": "2022-12-29T18:45:08.617", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:easy-static-server_project:easy-static-server:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "2A25B608-642D-4A44-B2E8-305D7340AE25"}], "operator": "OR"}]}], "sourceIdentifier": "report@snyk.io"}