CVE-2018-6184 - Vulnerability Details

Vendors	Products
Zeit	Next.js

Link	Providers
https://github.com/zeit/next.js/releases/tag/4.2.3

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2018-01-24T00:00:00", "descriptions": [{"lang": "en", "value": "ZEIT Next.js 4 before 4.2.3 has Directory Traversal under the /_next request namespace."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-01-24T09:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/zeit/next.js/releases/tag/4.2.3"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2018-6184", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "ZEIT Next.js 4 before 4.2.3 has Directory Traversal under the /_next request namespace."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://github.com/zeit/next.js/releases/tag/4.2.3", "refsource": "CONFIRM", "url": "https://github.com/zeit/next.js/releases/tag/4.2.3"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T05:54:53.307Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/zeit/next.js/releases/tag/4.2.3"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2018-6184", "datePublished": "2018-01-24T10:00:00", "dateReserved": "2018-01-24T00:00:00", "dateUpdated": "2024-08-05T05:54:53.307Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : n/a (string)

vendor : n/a (string)

versions : [ »

0 : { »

status : affected (string)

version : n/a (string)

}

]

}

]

datePublic : 2018-01-24T00:00:00 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : ZEIT Next.js 4 before 4.2.3 has Directory Traversal under the /_next request namespace. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

description : n/a (string)

lang : en (string)

type : text (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2018-01-24T09:57:01 (string)

orgId : 8254265b-2729-46b6-b9e3-3dfca2d5bfca (string)

shortName : mitre (string)

}

references : [ »

0 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

]

url : https://github.com/zeit/next.js/releases/tag/4.2.3 (string)

}

]

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : cve@mitre.org (string)

ID : CVE-2018-6184 (string)

STATE : PUBLIC (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : n/a (string)

version : { »

version_data : [ »

0 : { »

version_value : n/a (string)

}

]

}

]

}

vendor_name : n/a (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : ZEIT Next.js 4 before 4.2.3 has Directory Traversal under the /_next request namespace. (string)

}

]

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : n/a (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : https://github.com/zeit/next.js/releases/tag/4.2.3 (string)

refsource : CONFIRM (string)

url : https://github.com/zeit/next.js/releases/tag/4.2.3 (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-05T05:54:53.307Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

1 : x_transferred (string)

]

url : https://github.com/zeit/next.js/releases/tag/4.2.3 (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : 8254265b-2729-46b6-b9e3-3dfca2d5bfca (string)

assignerShortName : mitre (string)

cveId : CVE-2018-6184 (string)

datePublished : 2018-01-24T10:00:00 (string)

dateReserved : 2018-01-24T00:00:00 (string)

dateUpdated : 2024-08-05T05:54:53.307Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:zeit:next.js:4.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "FF308D52-C219-4512-85D0-32C99517CC9F", "vulnerable": true}, {"criteria": "cpe:2.3:a:zeit:next.js:4.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "C9B097A4-BF26-4D4B-8641-B9C17738B900", "vulnerable": true}, {"criteria": "cpe:2.3:a:zeit:next.js:4.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "864DF585-629C-488A-96A9-61819C5B0A13", "vulnerable": true}, {"criteria": "cpe:2.3:a:zeit:next.js:4.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "E746E3A9-C346-468F-92EB-7E8DA7BEFEE9", "vulnerable": true}, {"criteria": "cpe:2.3:a:zeit:next.js:4.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "DF82B998-1D5D-433F-BA7C-D6304CF4D5F7", "vulnerable": true}, {"criteria": "cpe:2.3:a:zeit:next.js:4.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "D1F0FAA0-5A32-4450-B7A5-71AFB795EE2B", "vulnerable": true}, {"criteria": "cpe:2.3:a:zeit:next.js:4.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "F61C3C63-1E69-45D2-BACF-1938699C2DC5", "vulnerable": true}, {"criteria": "cpe:2.3:a:zeit:next.js:4.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "304F8CD9-D6D6-406D-9C09-264D619602F4", "vulnerable": true}, {"criteria": "cpe:2.3:a:zeit:next.js:4.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "E9CD5807-CC5D-4341-8B66-2255685A3F5A", "vulnerable": true}, {"criteria": "cpe:2.3:a:zeit:next.js:4.1.3:*:*:*:*:*:*:*", "matchCriteriaId": "817B6FDF-E2D6-43EF-8728-2FB0D360D65C", "vulnerable": true}, {"criteria": "cpe:2.3:a:zeit:next.js:4.1.4:*:*:*:*:*:*:*", "matchCriteriaId": "5BBB30EF-9483-4CFA-AD04-806452FDBAA8", "vulnerable": true}, {"criteria": "cpe:2.3:a:zeit:next.js:4.1.4:canary_1:*:*:*:*:*:*", "matchCriteriaId": "4BDEBC17-F520-4949-8C89-B495EA634C2E", "vulnerable": true}, {"criteria": "cpe:2.3:a:zeit:next.js:4.1.4:canary_2:*:*:*:*:*:*", "matchCriteriaId": "B9990ABE-3103-4F0A-9719-BB0E2C5E78C4", "vulnerable": true}, {"criteria": "cpe:2.3:a:zeit:next.js:4.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "E077A185-C0B9-42B1-986B-90E2AC7C26F2", "vulnerable": true}, {"criteria": "cpe:2.3:a:zeit:next.js:4.2.0:canary_1:*:*:*:*:*:*", "matchCriteriaId": "07E3AD57-49F9-4878-A6B1-157504E0CC21", "vulnerable": true}, {"criteria": "cpe:2.3:a:zeit:next.js:4.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "B5683332-125F-4535-9068-EAF5526BD802", "vulnerable": true}, {"criteria": "cpe:2.3:a:zeit:next.js:4.2.2:*:*:*:*:*:*:*", "matchCriteriaId": "93B78182-12B0-4DB3-9762-B7965F182656", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "ZEIT Next.js 4 before 4.2.3 has Directory Traversal under the /_next request namespace."}, {"lang": "es", "value": "ZEIT Next.js 4 en versiones anteriores a la 4.2.3 tiene un salto de directorio bajo el espacio de nombre de petici\u00f3n /_next."}], "id": "CVE-2018-6184", "lastModified": "2024-11-21T04:10:14.563", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-01-24T10:29:01.020", "references": [{"source": "cve@mitre.org", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://github.com/zeit/next.js/releases/tag/4.2.3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://github.com/zeit/next.js/releases/tag/4.2.3"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:zeit:next.js:4.0.0:*:*:*:*:*:*:* (string)

matchCriteriaId : FF308D52-C219-4512-85D0-32C99517CC9F (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:zeit:next.js:4.0.1:*:*:*:*:*:*:* (string)

matchCriteriaId : C9B097A4-BF26-4D4B-8641-B9C17738B900 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:zeit:next.js:4.0.2:*:*:*:*:*:*:* (string)

matchCriteriaId : 864DF585-629C-488A-96A9-61819C5B0A13 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:zeit:next.js:4.0.3:*:*:*:*:*:*:* (string)

matchCriteriaId : E746E3A9-C346-468F-92EB-7E8DA7BEFEE9 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:zeit:next.js:4.0.4:*:*:*:*:*:*:* (string)

matchCriteriaId : DF82B998-1D5D-433F-BA7C-D6304CF4D5F7 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:zeit:next.js:4.0.5:*:*:*:*:*:*:* (string)

matchCriteriaId : D1F0FAA0-5A32-4450-B7A5-71AFB795EE2B (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:zeit:next.js:4.1.0:*:*:*:*:*:*:* (string)

matchCriteriaId : F61C3C63-1E69-45D2-BACF-1938699C2DC5 (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:zeit:next.js:4.1.1:*:*:*:*:*:*:* (string)

matchCriteriaId : 304F8CD9-D6D6-406D-9C09-264D619602F4 (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:zeit:next.js:4.1.2:*:*:*:*:*:*:* (string)

matchCriteriaId : E9CD5807-CC5D-4341-8B66-2255685A3F5A (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:zeit:next.js:4.1.3:*:*:*:*:*:*:* (string)

matchCriteriaId : 817B6FDF-E2D6-43EF-8728-2FB0D360D65C (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:zeit:next.js:4.1.4:*:*:*:*:*:*:* (string)

matchCriteriaId : 5BBB30EF-9483-4CFA-AD04-806452FDBAA8 (string)

vulnerable : true (boolean)

}

11 : { »

criteria : cpe:2.3:a:zeit:next.js:4.1.4:canary_1:*:*:*:*:*:* (string)

matchCriteriaId : 4BDEBC17-F520-4949-8C89-B495EA634C2E (string)

vulnerable : true (boolean)

}

12 : { »

criteria : cpe:2.3:a:zeit:next.js:4.1.4:canary_2:*:*:*:*:*:* (string)

matchCriteriaId : B9990ABE-3103-4F0A-9719-BB0E2C5E78C4 (string)

vulnerable : true (boolean)

}

13 : { »

criteria : cpe:2.3:a:zeit:next.js:4.2.0:*:*:*:*:*:*:* (string)

matchCriteriaId : E077A185-C0B9-42B1-986B-90E2AC7C26F2 (string)

vulnerable : true (boolean)

}

14 : { »

criteria : cpe:2.3:a:zeit:next.js:4.2.0:canary_1:*:*:*:*:*:* (string)

matchCriteriaId : 07E3AD57-49F9-4878-A6B1-157504E0CC21 (string)

vulnerable : true (boolean)

}

15 : { »

criteria : cpe:2.3:a:zeit:next.js:4.2.1:*:*:*:*:*:*:* (string)

matchCriteriaId : B5683332-125F-4535-9068-EAF5526BD802 (string)

vulnerable : true (boolean)

}

16 : { »

criteria : cpe:2.3:a:zeit:next.js:4.2.2:*:*:*:*:*:*:* (string)

matchCriteriaId : 93B78182-12B0-4DB3-9762-B7965F182656 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : ZEIT Next.js 4 before 4.2.3 has Directory Traversal under the /_next request namespace. (string)

}

1 : { »

lang : es (string)

value : ZEIT Next.js 4 en versiones anteriores a la 4.2.3 tiene un salto de directorio bajo el espacio de nombre de petición /_next. (string)

}

]

id : CVE-2018-6184 (string)

lastModified : 2024-11-21T04:10:14.563 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : MEDIUM (string)

cvssData : { »

accessComplexity : LOW (string)

accessVector : NETWORK (string)

authentication : NONE (string)

availabilityImpact : NONE (string)

baseScore : 5 (number)

confidentialityImpact : PARTIAL (string)

integrityImpact : NONE (string)

vectorString : AV:N/AC:L/Au:N/C:P/I:N/A:N (string)

version : 2.0 (string)

}

exploitabilityScore : 10 (number)

impactScore : 2.9 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : false (boolean)

}

]

cvssMetricV30 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.0 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 3.6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2018-01-24T10:29:01.020 (string)

references : [ »

0 : { »

source : cve@mitre.org (string)

tags : [ »

0 : Issue Tracking (string)

1 : Third Party Advisory (string)

]

url : https://github.com/zeit/next.js/releases/tag/4.2.3 (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Issue Tracking (string)

1 : Third Party Advisory (string)

]

url : https://github.com/zeit/next.js/releases/tag/4.2.3 (string)

}

]

sourceIdentifier : cve@mitre.org (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-22 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object