Directory Traversal in evershop - @evershop/evershop - GHSA-4wrm-qmq2-5fjx

Description

Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the readDirSync function in fileBrowser/browser.js.

Recommendation

Update the @evershop/evershop package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.0.0-rc.8
• Patched version(s): 1.0.0-rc.8

References

• GHSA-4wrm-qmq2-5fjx
• devhub.checkmarx.com
• CVE-2023-46493
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Directory Traversal in evershop - @evershop/evershop - CVE-2023-46496
• Directory Traversal in evershop - CVE-2023-46497
• Cross-site Scripting in evershop - @evershop/evershop - GHSA-2xcj-557c-hf8r - CVE-2023-46495
• EverShop at risk to unauthorized access via weak HMAC secret - CVE-2023-46943

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

@evershop/evershop