Stored Cross-Site Scripting in tianma-static

MEDIO 6.1CVE-2018-16474 · GHSA-jhgp-hvj6-x2p2 · Published 06/11/2018 · updated 17/06/2026

In breve

CVE-2018-16474 è una vulnerabilità MEDIO (CVSS 6.1) che riguarda tianma-static (tianma-static project), tianma-static.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.77%, superiore al 55.7% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
tianma-static tianma-static_project	`≤ 1.0.4`	No fix yet
tianma-static npm	`≤ 1.0.4`	No fix yet

Description

All versions of tianma-static are vulnerable to stored cross-site scripting (XSS). The vulnerability is exploitable if a user can control the name of a file that is served by tianma-static

Recommendation

As no fix is available for this vulnerability at this time it is our recommendation to use another static file server.

NVD description

A stored xss in tianma-static module versions <=1.0.4 allows an attacker to execute arbitrary javascript.

References

nvd.nist.gov/vuln/detail/CVE-2018-16474 · ADVISORY
hackerone.com/reports/403692 · WEB
GitHub Advisory GHSA-jhgp-hvj6-x2p2 · ADVISORY
npmjs.com/advisories/741 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free