Cross-Site Scripting in serve-index

MEDIO 6.1CVE-2015-8856 · GHSA-v633-x5vv-hqwc · Published 23/01/2017 · updated 17/06/2026

In breve

CVE-2015-8856 è una vulnerabilità MEDIO (CVSS 6.1) che riguarda serve-index (openjsf), serve-index.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.5%, superiore al 84.6% delle vulnerabilità.
Correzione: aggiornare a 1.6.3 o successiva.

Package	Affected versions	Patched versions
serve-index openjsf	`< 1.6.3`	`1.6.3`
serve-index npm	`< 1.6.3`	`1.6.3`

Description

Versions 1.6.2 and earlier of serve-index are affected by a cross-site scripting vulnerability. Because file and directory names are not escaped in the module's HTML output, a remote attacker that can influence file or directory names can launch a persistent cross-site scripting attack on the application.

Recommendation

Update to version 1.6.3 or later.

NVD description

Cross-site scripting (XSS) vulnerability in the serve-index package before 1.6.3 for Node.js allows remote attackers to inject arbitrary web script or HTML via a crafted file or directory name.

References

nvd.nist.gov/vuln/detail/CVE-2015-8856 · ADVISORY
expressjs/serve-index · WEB
expressjs/serve-index commit 7381a1d · WEB
expressjs/serve-index · PACKAGE
web.archive.org/web/20200227190911/http://www.securityfocus.com/bid/96392 · WEB
openwall.com/lists/oss-security/2016/04/20/11 · WEB
securityfocus.com/bid/96392 · Broken Link
nodesecurity.io/advisories/34 · Patch

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free