Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXY2MzMteDV2di1ocXdj

Cross-Site Scripting in serve-index

Versions 1.6.2 and earlier of serve-index are affected by a cross-site scripting vulnerability. Because file and directory names are not escaped in the module's HTML output, a remote attacker that can influence file or directory names can launch a persistent cross-site scripting attack on the application.

Recommendation

Update to version 1.6.3 or later.

Permalink: https://github.com/advisories/GHSA-v633-x5vv-hqwc
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXY2MzMteDV2di1ocXdj
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 7 years ago
Updated: about 1 year ago

CVSS Score: 6.1
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Percentage: 0.00113
EPSS Percentile: 0.45502

Identifiers: GHSA-v633-x5vv-hqwc, CVE-2015-8856
References:

• https://nvd.nist.gov/vuln/detail/CVE-2015-8856
• https://github.com/expressjs/serve-index/issues/28
• http://www.openwall.com/lists/oss-security/2016/04/20/11
• https://github.com/expressjs/serve-index/commit/7381a1d1458959e57ee53ac932b06ff17904777e
• https://web.archive.org/web/20200227190911/http://www.securityfocus.com/bid/96392
• https://github.com/advisories/GHSA-v633-x5vv-hqwc

Repository: https://github.com/expressjs/serve-index
Blast Radius: 39.6

Affected Packages