Description
dasafio is a web server. dasafio is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. File access is restricted to only .html files.
Remediation
References
https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/dasafio
https://nodesecurity.io/advisories/460
Related Vulnerabilities
CVE-2020-28500 Vulnerability in npm package lodash
CVE-2023-38992 Vulnerability in maven package org.jeecgframework.boot:jeecg-boot-common
CVE-2021-23419 Vulnerability in npm package open-graph
CVE-2023-48089 Vulnerability in maven package com.xuxueli:xxl-job-admin
CVE-2021-42392 Vulnerability in maven package com.h2database:h2