Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWY1bWgtaHE2aC13aHh2

Directory Traversal in bitty

Affected versions of bitty are vulnerable to directory traversal via the URL path in GET requests.

Recommendation

The bitty package is not currently maintained, and has not seen an update since 2015.

At this time, the best available mitigation is to use an alternative module that is actively maintained and provides similar functionality, such as serve.

Permalink: https://github.com/advisories/GHSA-f5mh-hq6h-whxv
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWY1bWgtaHE2aC13aHh2
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 5 years ago
Updated: over 1 year ago


Identifiers: GHSA-f5mh-hq6h-whxv, CVE-2016-10561
References: Blast Radius: 0.0

Affected Packages

npm:bitty
Dependent packages: 1
Dependent repositories: 1
Downloads: 84 last month
Affected Version Ranges: <= 0.2.10
No known fixed version
All affected versions: 0.0.1, 0.0.3, 0.0.4, 0.0.5, 0.0.6, 0.0.7, 0.0.8, 0.0.9, 0.0.10, 0.0.11, 0.0.13, 0.1.0, 0.1.1, 0.1.2, 0.2.0, 0.2.1, 0.2.2, 0.2.3, 0.2.4, 0.2.5, 0.2.6, 0.2.7, 0.2.8, 0.2.9, 0.2.10