CVE-2022-25848

Katalog CVE

CVSS 7.5 · High EPSS 1,0%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada static-dev-server project static-dev-server. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

This affects all versions of package static-dev-server. This is because when paths from users to the root directory are joined, the assets for the path accessed are relative to that of the root directory.

Rincian

Terbit di NVD

29 November 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 62,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gist.github.com/lirantal/5550bcd0bdf92c1b56fbb20e141fe5bd exploit · advisory pihak ketiga
• https://security.snyk.io/vuln/SNYK-JS-STATICDEVSERVER-3149917 exploit · advisory pihak ketiga