En bref
- CVE-2018-3732 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant resolve-path (resolve-path project), resolve-path.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 2.4%, plus élevée que 83.9% des vulnérabilités.
- Correctif : mettre à jour vers 1.4.0 ou plus récent.
Description
Versions of resolve-path before 1.4.0 are vulnerable to path traversal. resolve-path relative path resolving suffers from a lack of file path sanitization for windows based paths.
Recommendation
Update to version 1.4.0 or later.
NVD description
resolve-path node module before 1.4.0 suffers from a Path Traversal vulnerability due to lack of validation of paths with certain special characters, which allows a malicious user to read content of any file with known path.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free