Path Traversal in angular-http-server

Description

Affected versions of angular-http-server are vulnerable to path traversal allowing a remote attacker to read files from the server that uses angular-http-server.

Recommendation

Update the angular-http-server package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.6.0
• Patched version(s): 1.6.0

References

• GHSA-4rvg-955w-h68q
• hackerone.com
• www.npmjs.com
• CVE-2018-3713
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• PrismJS DOM Clobbering vulnerability - CVE-2024-53382
• Server-Side Request Forgery in axios - CVE-2024-39338
• DOS by abusing `fetchOptions.retry`. - CVE-2023-49800
• Prototype Pollution in querystringify - Vulnerability

Tags:

npm

angular-http-server