high7.5
CVE-2017-14849
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation …
Impact
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nodejs | Node.Js | Version 8.5.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.securityfocus.com/bid/101056
- https://nodejs.org/en/blog/vulnerability/september-2017-path-validation/
- https://twitter.com/nodejs/status/913131152868876288
- http://www.securityfocus.com/bid/101056
- https://nodejs.org/en/blog/vulnerability/september-2017-path-validation/
- https://twitter.com/nodejs/status/913131152868876288