VulnerabilityModified
CVE-2014-3744
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in an unspecified path.
HIGH 7.5EPSS 34.0%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 34.0%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in an unspecified path.
- CVSS 3.0
- 7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 34.01% probability · 98th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- nodejs/node.js
- Source
- cve@mitre.org
References
- http://www.openwall.com/lists/oss-security/2014/05/13/1Mailing List
- http://www.openwall.com/lists/oss-security/2014/05/15/2Mailing List
- http://www.securityfocus.com/bid/67389Third Party Advisory, VDB Entry
- https://github.com/isaacs/stThird Party Advisory
- https://nodesecurity.io/advisories/st_directory_traversalThird Party Advisory
- http://www.openwall.com/lists/oss-security/2014/05/13/1Mailing List
- http://www.openwall.com/lists/oss-security/2014/05/15/2Mailing List
- http://www.securityfocus.com/bid/67389Third Party Advisory, VDB Entry
- https://github.com/isaacs/stThird Party Advisory
- https://nodesecurity.io/advisories/st_directory_traversalThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.