Cross-site Scripting (XSS) - Stored in crud-file-server

MEDIO 6.1CVE-2018-3726 · GHSA-h24f-9mm4-w336 · Published 07/06/2018 · updated 17/06/2026

In breve

CVE-2018-3726 è una vulnerabilità MEDIO (CVSS 6.1) che riguarda crud-file-server (crud-file-server project), crud-file-server.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.1%, superiore al 64.7% delle vulnerabilità.
Correzione: aggiornare a 0.8.0 o successiva.

Package	Affected versions	Patched versions
crud-file-server crud-file-server_project	`< 0.8.0`	`0.8.0`
crud-file-server npm	`< 0.8.0`	`0.8.0`

Description

Versions of crud-file-server before 0.8.0 are vulnerable to stored cross-site scripting (XSS). This is due to insufficient santiziation of filenames when directory index is served by crud-file-server.

Recommendation

Update to version 0.8.0 or later.

NVD description

crud-file-server node module before 0.8.0 suffers from a Cross-Site Scripting vulnerability to a lack of validation of file names.

References

nvd.nist.gov/vuln/detail/CVE-2018-3726 · ADVISORY
omphalos/crud-file-server commit 4155bfe · WEB
hackerone.com/reports/311101 · WEB
GitHub Advisory GHSA-h24f-9mm4-w336 · ADVISORY
npmjs.com/advisories/570 · WEB

Altre vulnerabilità di crud-file-server

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free