Description
utahcityfinder constructs lists of Utah cities with a certain prefix. utahcityfinder is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Remediation
References
https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/utahcityfinder
https://nodesecurity.io/advisories/467
Related Vulnerabilities
CVE-2021-22696 Vulnerability in maven package org.apache.cxf:cxf-rt-rs-security-oauth2
CVE-2022-25898 Vulnerability in maven package org.webjars.bower:jsrsasign
CVE-2021-27290 Vulnerability in npm package ssri
CVE-2023-34660 Vulnerability in maven package org.jeecgframework.boot:jeecg-boot-parent
CVE-2022-23496 Vulnerability in maven package nl.basjes.parse.useragent:yauaa-elastic-udfs-parent