CVE-2014-10068

描述

Versions 1.1.1 and earlier of `inert` are vulnerable to an information leakage vulnerability which causes files in hidden directories to be served, even when showHidden is false. The inert directory handler always allows files in hidden directories to be served, even when `showHidden` is false. ## Recommendation Update to version >= 1.1.1.

如何修補 CVE-2014-10068

要修補 CVE-2014-10068,請將受影響套件升級到下列已修補版本。

• npm/inert—升級至 1.1.1 或更新版本

CVE-2014-10068 正在被利用嗎?

低 — EPSS 為 0.5%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 1.1.1

參考連結(4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2014-10068
• WEBgithub.com/hapijs/inert/commit/e8f99f94da4cb08e8032eda984761c3f111e3e82
• WEBgithub.com/hapijs/inert/pull/15
• WEBwww.npmjs.com/advisories/14