Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXY2MzMteDV2di1ocXdj
Cross-Site Scripting in serve-index
Versions 1.6.2 and earlier of serve-index are affected by a cross-site scripting vulnerability. Because file and directory names are not escaped in the module's HTML output, a remote attacker that can influence file or directory names can launch a persistent cross-site scripting attack on the application.
Recommendation
Update to version 1.6.3 or later.
Permalink: https://github.com/advisories/GHSA-v633-x5vv-hqwcJSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXY2MzMteDV2di1ocXdj
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 6 years ago
Updated: 6 months ago
CVSS Score: 6.1
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Identifiers: GHSA-v633-x5vv-hqwc, CVE-2015-8856
References:
- https://nvd.nist.gov/vuln/detail/CVE-2015-8856
- https://github.com/expressjs/serve-index/issues/28
- http://www.openwall.com/lists/oss-security/2016/04/20/11
- https://github.com/expressjs/serve-index/commit/7381a1d1458959e57ee53ac932b06ff17904777e
- https://web.archive.org/web/20200227190911/http://www.securityfocus.com/bid/96392
- https://github.com/advisories/GHSA-v633-x5vv-hqwc
Blast Radius: 39.6
Affected Packages
npm:serve-index
Dependent packages: 1,319Dependent repositories: 3,089,164
Downloads: 49,259,715 last month
Affected Version Ranges: < 1.6.3
Fixed in: 1.6.3
All affected versions: 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.1.6, 1.2.0, 1.2.1, 1.3.0, 1.3.1, 1.4.0, 1.4.1, 1.5.0, 1.5.1, 1.5.2, 1.5.3, 1.6.0, 1.6.1, 1.6.2
All unaffected versions: 1.6.3, 1.6.4, 1.7.0, 1.7.1, 1.7.2, 1.7.3, 1.8.0, 1.9.0, 1.9.1