CVE-2014-125098

MEDIO 6.1CVE-2014-125098 · Published 10/04/2023 · updated 17/06/2026

En resumen

CVE-2014-125098 es una vulnerabilidad MEDIO (CVSS 6.1) que afecta a http server (dart).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.62%, mayor que el 49.6% de las vulnerabilidades.
Solución: actualizar a 0.9.6 o posterior.

Package	Affected versions	Patched versions
http server dart	`< 0.9.6`	`0.9.6`

Description

A vulnerability was found in Dart http_server up to 0.9.5 and classified as problematic. Affected by this issue is the function VirtualDirectory of the file lib/src/virtual_directory.dart of the component Directory Listing Handler. The manipulation of the argument request.uri.path leads to cross site scripting. The attack may be launched remotely. Upgrading to version 0.9.6 is able to address this issue. The name of the patch is 27c1cbd8125bb0369e675eb72e48218496e48ffb. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-225356.

References

codereview.chromium.org/225813002 · Patch
dart-archive/http_server commit 27c1cbd · Patch
dart-archive/http_server release 0.9.6 · Release Notes
vuldb.com · Permissions Required
vuldb.com · Permissions Required

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free