CVE-2014-3744 Directory Traversal in st
HighCVSS 7.5
EPSS 34.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in an unspecified path.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm st(npm) | < 0.2.5 | 0.2.5 |
| nodejs node.js | <= 0.2.4 | No fix listed |
References
- github.com third-party-advisory
- www.npmjs.com
- nvd.nist.gov third-party-advisory
- [oss-security] 20140513 CVE request: various NodeJS module vulnerabilities mailing-list
- [oss-security] 20140514 Re: CVE request: various NodeJS module vulnerabilities mailing-list
- 67389 third-party-advisory vdb-entry
- github.com
- nodesecurity.io third-party-advisory