Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2022-25895

Date: December 21, 2022

All versions of package lite-dev-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed to the req.url user input that is passed to the server code.

Severity Score

Related Resources (6)

https://github.com/shadowwzw/lite-dev-server/blob/master/src/server.js%23L134
https://github.com/shadowwzw/lite-dev-server/blob/master/src/server.js#23L134
https://github.com/shadowwzw/lite-dev-server
https://gist.github.com/lirantal/0f8a48c3f5ac581ce73123abe9f7f120
https://nvd.nist.gov/vuln/detail/CVE-2022-25895
https://www.mend.io/vulnerability-database/CVE-2022-25895

Severity Score

Weakness Type (CWE)

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us