Em resumo
- CVE-2018-16484 é uma vulnerabilidade MÉDIO (CVSS 5.4) que afeta m-server (m-server project), m-server.
- Chance de exploração nos próximos 30 dias (EPSS): 0.61%, maior que 49.2% das vulnerabilidades.
- Correção: atualize para 1.4.2 ou posterior.
| Package | Affected versions | Patched versions |
|---|
| m-server | < 1.4.2
| 1.4.2
|
| m-server npm | < 1.4.2
| 1.4.2
|
Description
Versions of m-server before 1.4.2 are vulnerable to stored cross-site scripting. This vulnerability is exploitable if an attacker is able to control the name of a file that m-server is serving.
Recommendation
Update to version 1.4.2 or later.
NVD description
A XSS vulnerability was found in module m-server <1.4.2 that allows malicious Javascript code or HTML to be executed, due to the lack of escaping for special characters in folder names.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free