En bref
- CVE-2018-16484 est une vulnérabilité MOYENNE (CVSS 5.4) touchant m-server (m-server project), m-server.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.61%, plus élevée que 49.2% des vulnérabilités.
- Correctif : mettre à jour vers 1.4.2 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| m-server | < 1.4.2
| 1.4.2
|
| m-server npm | < 1.4.2
| 1.4.2
|
Description
Versions of m-server before 1.4.2 are vulnerable to stored cross-site scripting. This vulnerability is exploitable if an attacker is able to control the name of a file that m-server is serving.
Recommendation
Update to version 1.4.2 or later.
NVD description
A XSS vulnerability was found in module m-server <1.4.2 that allows malicious Javascript code or HTML to be executed, due to the lack of escaping for special characters in folder names.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free