Kurz gesagt
- CVE-2018-16484 ist eine Schwachstelle (MITTEL (CVSS 5.4)) in m-server (m-server project), m-server.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.61%, höher als bei 49.2% aller Schwachstellen.
- Abhilfe: auf 1.4.2 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| m-server | < 1.4.2
| 1.4.2
|
| m-server npm | < 1.4.2
| 1.4.2
|
Description
Versions of m-server before 1.4.2 are vulnerable to stored cross-site scripting. This vulnerability is exploitable if an attacker is able to control the name of a file that m-server is serving.
Recommendation
Update to version 1.4.2 or later.
NVD description
A XSS vulnerability was found in module m-server <1.4.2 that allows malicious Javascript code or HTML to be executed, due to the lack of escaping for special characters in folder names.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free