En bref
- CVE-2019-5437 est une vulnérabilité MOYENNE (CVSS 5.3) touchant harp (harpjs), harp.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.3%, plus élevée que 70.8% des vulnérabilités.
- Correctif : mettre à jour vers 0.40.2 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| harp | ≤ 0.29.0
| No fix yet |
| harp npm | < 0.40.2
| 0.40.2
|
Description
Affected versions of harp are vulnerable to Unauthorized File Access. The package states that it ignores files and directories with names that start with an underscore, such as _secret-folder. If the underscore character is URL encoded the server delivers the file.
Recommendation
Upgrade to version 0.40.2 or later.
NVD description
Information exposure through the directory listing in npm's harp module allows to access files that are supposed to be ignored according to the harp server rules.Vulnerable versions are <= 0.29.0 and no fix was applied to our knowledge.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free