Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.
CVSS Details
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade node | Oct 10, 2017 | Oct 10, 2017 |
| Suse | — | Upgrade firefox-gdk-pixbuf-langUpgrade mozilla-nspr-32bitUpgrade mozilla-nss-develUpgrade firefox-gtk3-langUpgrade MozillaFirefox-translations-commonUpgrade mozilla-nss-toolsUpgrade libfreebl3-32bitUpgrade libfirefox-gobject-2_0-0Upgrade libsoftokn3-32bitUpgrade firefox-libatk-1_0-0Upgrade firefox-gdk-pixbuf-thumbnailerUpgrade firefox-atk-langUpgrade MozillaFirefoxUpgrade firefox-gtk3-immodules-tigrignaUpgrade firefox-libcairo-gobject2Upgrade mozilla-nsprUpgrade firefox-gtk3-immodule-inuktitutUpgrade mozilla-nss-32bitUpgrade nodejs8-docsUpgrade firefox-gio-branding-upstreamUpgrade libfirefox-gthread-2_0-0Upgrade libfirefox-gio-2_0-0Upgrade nodejs8Upgrade firefox-libpango-1_0-0Upgrade firefox-gtk3-dataUpgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade firefox-gtk3-immodule-amharicUpgrade libfirefox-gmodule-2_0-0Upgrade npm8Upgrade mozilla-nspr-develUpgrade nodejs8-develUpgrade firefox-gtk3-immodule-thaiUpgrade firefox-gtk3-branding-upstreamUpgrade libsoftokn3Upgrade firefox-libffi4Upgrade mozilla-nss-certsUpgrade firefox-libffi7Upgrade firefox-glib2-langUpgrade libfreebl3Upgrade mozilla-nssUpgrade firefox-gtk3-toolsUpgrade MozillaFirefox-translations-otherUpgrade firefox-gtk3-immodule-multipressUpgrade mozilla-nss-certs-32bitUpgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-libgtk-3-0Upgrade firefox-libharfbuzz0Upgrade MozillaFirefox-branding-SLEDUpgrade firefox-gtk3-immodule-ximUpgrade firefox-glib2-toolsUpgrade firefox-libcairo2Upgrade libfirefox-glib-2_0-0 | Dec 12, 2019 | Sep 27, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub