Description

dylmomo is a simple file server. dylmomo is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.

Remediation

References

https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/dylmomo

https://nodesecurity.io/advisories/396

Related Vulnerabilities

CVE-2020-26256 Vulnerability in maven package org.webjars.npm:fast-csv

CVE-2020-36732 Vulnerability in maven package org.webjars.npm:crypto-js

CVE-2020-27885 Vulnerability in maven package org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.store.feature

CVE-2023-24162 Vulnerability in maven package cn.hutool:hutool-all

CVE-2023-38905 Vulnerability in maven package org.jeecgframework.boot:jeecg-boot-base-core

Severity

High

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Exploit Third Party Advisory CWE-22