mcstatic directory traversal vulnerability

Description

A server directory traversal vulnerability was found on node module mcstatic <=0.0.20 that would allow an attack to access sensitive information in the file system by appending slashes in the URL path.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 0.0.20

References

• GHSA-cxmj-qjv6-vx9p
• hackerone.com
• CVE-2018-16482
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Stimulsoft Dashboard.JS directory traversal vulnerability - CVE-2024-24398
• Path Traversal in mcstatic - CVE-2018-3730
• Directory Traversal vulnerability in serve-lite - CVE-2022-21192
• React Native Document Picker Directory Traversal vulnerability - CVE-2024-25466

You might also like:

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Exploiting Server Version Disclosure

Tags:

npm

mcstatic