CVE-2015-5688

描述

Versions 13.0.8 and earlier of geddy are vulnerable to a directory traversal attack via URI encoded attack vectors. ### Proof of Concept ``` http://localhost:4000/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd ``` ## Recommendation Update geddy to version >= 13.0.8

如何修補 CVE-2015-5688

要修補 CVE-2015-5688,請將受影響套件升級到下列已修補版本。

• npm/geddy—升級至 13.0.8 或更新版本

CVE-2015-5688 正在被利用嗎?

中等 — EPSS 為 9.4%,可持續追蹤但非最高優先。

受影響套件(1)

• from 0, < 13.0.8

參考連結(8)

• ADVISORYgithub.com/advisories/GHSA-333x-9vgq-v2j4
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2015-5688
• PATCHgithub.com/geddy/geddy
• WEBgithub.com/geddy/geddy/commit/2de63b68b3aa6c08848f261ace550a37959ef231
• WEB