Description
crud-file-server node module before 0.8.0 suffers from a Cross-Site Scripting vulnerability to a lack of validation of file names.
Remediation
References
https://github.com/omphalos/crud-file-server/commit/4155bfe068bf211b49a0b3ffd06e78cbaf1b40fa
https://hackerone.com/reports/311101
Related Vulnerabilities
CVE-2021-21343 Vulnerability in maven package com.thoughtworks.xstream:xstream
CVE-2011-2526 Vulnerability in maven package org.apache.tomcat:catalina
CVE-2022-43411 Vulnerability in maven package org.jenkins-ci.plugins:gitlab-plugin
CVE-2022-29577 Vulnerability in maven package org.owasp.antisamy:antisamy
CVE-2022-45146 Vulnerability in maven package org.bouncycastle:bc-fips