CVE-2024-31207

{"id": "CVE-2024-31207", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "published": "2024-04-04T16:15:09.333", "references": [{"url": "https://github.com/vitejs/vite/commit/011bbca350e447d1b499d242804ce62738c12bc0", "source": "security-advisories@github.com"}, {"url": "https://github.com/vitejs/vite/commit/5a056dd2fc80dbafed033062fe6aaf4717309f48", "source": "security-advisories@github.com"}, {"url": "https://github.com/vitejs/vite/commit/89c7c645f09d16a38f146ef4a1528f218e844d67", "source": "security-advisories@github.com"}, {"url": "https://github.com/vitejs/vite/commit/96a7f3a41ef2f9351c46f3ab12489bb4efa03cc9", "source": "security-advisories@github.com"}, {"url": "https://github.com/vitejs/vite/commit/ba5269cca81de3f5fbb0f49d58a1c55688043258", "source": "security-advisories@github.com"}, {"url": "https://github.com/vitejs/vite/commit/d2db33f7d4b96750b35370c70dd2c35ec3b9b649", "source": "security-advisories@github.com"}, {"url": "https://github.com/vitejs/vite/security/advisories/GHSA-8jhw-289h-jh2g", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "Vite (French word for \"quick\", pronounced /vit/, like \"veet\") is a frontend build tooling to improve the frontend development experience.`server.fs.deny` does not deny requests for patterns with directories. This vulnerability has been patched in version(s) 5.2.6, 5.1.7, 5.0.13, 4.5.3, 3.2.10 and 2.9.18."}, {"lang": "es", "value": "Vite (palabra francesa para \"r\u00e1pido\", pronunciada /vit/, como \"veet\") es una herramienta de construcci\u00f3n de frontend para mejorar la experiencia de desarrollo de frontend. `server.fs.deny` no niega solicitudes de patrones con directorios. Esta vulnerabilidad ha sido parcheada en las versiones 5.2.6, 5.1.7, 5.0.13, 4.5.3, 3.2.10 y 2.9.18."}], "lastModified": "2024-04-04T16:33:06.610", "sourceIdentifier": "security-advisories@github.com"}