PatchTheCVEserve vulnerabilities and fixes
Recent CVEs affecting serve, with upgrade or downgrade steps. 5 tracked.
serve has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 3. Most recent: 2019-03-21. Highest priority: CVE-2019-5417 (score 57/100).
- CVE-2019-5417 HIGH 7.5 UPGRADE A path traversal vulnerability in serve npm package version 7.0.1 allows the attackers to read content of arbi
- CVE-2019-5415 HIGH 7.5 DOWNGRADE A bug in handling the ignore files and directories feature in serve 6.5.3 allows an attacker to read a file or
- CVE-2018-3809 MEDIUM 5.3 DOWNGRADE Information exposure through directory listings in serve 6.5.3 allows directory listing and file access even w
- CVE-2018-3718 MEDIUM 5.3 UPGRADE serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a fi
- CVE-2018-3712 MEDIUM 6.5 UPGRADE serve node module before 6.4.9 suffers from a Path Traversal vulnerability due to not handling %2e (.) and %2f
FAQ
How do I fix serve vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is serve being exploited right now?
None of the tracked serve CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which serve CVE should I patch first?
CVE-2019-5417 currently ranks highest (57/100): A path traversal vulnerability in serve npm package version 7.0.1 allows the attackers to read content of arbi.