Directory Traversal in evershop

Description

Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the mkdirSync function in the folderCreate/createFolder.js endpoint.

Recommendation

Update the @evershop/evershop package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.0.0-rc.8
• Patched version(s): 1.0.0-rc.8

References

• GHSA-7443-5962-wp4r
• devhub.checkmarx.com
• CVE-2023-46497
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Directory Traversal in evershop - @evershop/evershop - CVE-2023-46496
• Directory Traversal in evershop - @evershop/evershop - GHSA-4wrm-qmq2-5fjx - CVE-2023-46493
• Cross-site Scripting in evershop - CVE-2023-46499
• Code execution in evershop - CVE-2023-46498

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

@evershop/evershop