Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWc0eHAtMzZjMy1mN21y

Hidden Directories Always Served in inert

Versions 1.1.1 and earlier of inert are vulnerable to an information leakage vulnerability which causes files in hidden directories to be served, even when showHidden is false.

The inert directory handler always allows files in hidden directories to be served, even when showHidden is false.

Recommendation

Update to version >= 1.1.1.

Permalink: https://github.com/advisories/GHSA-g4xp-36c3-f7mr
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWc0eHAtMzZjMy1mN21y
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 4 years ago
Updated: about 2 years ago

EPSS Percentage: 0.0017
EPSS Percentile: 0.5451

Identifiers: GHSA-g4xp-36c3-f7mr, CVE-2014-10068
References:

• https://github.com/hapijs/inert/pull/15
• https://github.com/hapijs/inert/commit/e8f99f94da4cb08e8032eda984761c3f111e3e82
• https://www.npmjs.com/advisories/14
• https://nvd.nist.gov/vuln/detail/CVE-2014-10068
• https://github.com/advisories/GHSA-g4xp-36c3-f7mr

Repository: https://github.com/hapijs/inert
Blast Radius: 0.0

Affected Packages