CVE-2022-25847 - OpenCVE

All versions of the package serve-lite are vulnerable to Cross-site Scripting (XSS) because when it detects a request to a directory, it renders a file listing of all of its contents with links that include the actual file names without any sanitization or output encoding.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Serve-lite Project	Serve-lite

Configuration 1 [-]

cpe:2.3:a:serve-lite_project:serve-lite:*:*:*:*:*:node.js:*:*

No data.

References

Link	Providers
https://gist.github.com/lirantal/52debd25284726fcc2eaed9c7512975c
https://security.snyk.io/vuln/SNYK-JS-SERVELITE-3149915

History

No history.

MITRE

Status: PUBLISHED

Assigner: snyk

Published: 2023-01-25T05:00:01.656Z

Updated: 2024-08-03T04:49:44.256Z

Reserved: 2022-02-24T11:58:25.184Z

Link: CVE-2022-25847

Vulnrichment

No data.

NVD

Status : Modified

Published: 2023-01-26T21:15:30.783

Modified: 2023-11-07T03:44:50.853

Link: CVE-2022-25847

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:serve-lite_project:serve-lite:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "DA50DEBE-C780-471A-815D-C28ACBAA2BF3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "All versions of the package serve-lite are vulnerable to Cross-site Scripting (XSS) because when it detects a request to a directory, it renders a file listing of all of its contents with links that include the actual file names without any sanitization or output encoding.\r\r"}, {"lang": "es", "value": "Todas las versiones del paquete server-lite son vulnerables a Cross-site Scripting (XSS) porque cuando detecta una solicitud a un directorio, muestra una lista de archivos de todo su contenido con enlaces que incluyen los nombres de archivos reales sin ning\u00fan tipo de sanitizaci\u00f3n o codificaci\u00f3n de salida."}], "id": "CVE-2022-25847", "lastModified": "2023-11-07T03:44:50.853", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "report@snyk.io", "type": "Secondary"}]}, "published": "2023-01-26T21:15:30.783", "references": [{"source": "report@snyk.io", "tags": ["Exploit", "Third Party Advisory"], "url": "https://gist.github.com/lirantal/52debd25284726fcc2eaed9c7512975c"}, {"source": "report@snyk.io", "tags": ["Third Party Advisory"], "url": "https://security.snyk.io/vuln/SNYK-JS-SERVELITE-3149915"}], "sourceIdentifier": "report@snyk.io", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "report@snyk.io", "type": "Secondary"}]}