CVE-2022-25847

 

Published at: - 26-01-2023 10:15

Last modified: - 27-01-2023 03:03

Total changes: - 2

Description

All versions of the package serve-lite are vulnerable to Cross-site Scripting (XSS) because when it detects a request to a directory, it renders a file listing of all of its contents with links that include the actual file names without any sanitization or output encoding.

Common Vulnerability Scoring System (CVSS)

-

 

Verification logic

 

Reference

• https://gist.github.com/lirantal/52debd25284726fcc2eaed9c7512975c
• https://security.snyk.io/vuln/SNYK-JS-SERVELITE-3149915

 

Keywords

NVD

 

CVE-2022-25847

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures