CVE-2018-3809 Information Exposure on Case Insensitive File Systems in serve
An attacker can access ignored files and directory listings in the serve package, leading to unauthorized information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-3809?
CVE-2018-3809 is a medium-severity vulnerability in n/a, published on 1 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Information exposure through directory listings in serve 6.5.3 allows directory listing and file access even when they have been set to be ignored.
Weakness: CWE-200
Which versions are affected by CVE-2018-3809?
2 open source packages ship an affected version, including serve. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
serve npm | All versions | 7.0.0 |
serve npm | All versions | 7.0.0 |
Products include Zeit Serve.
How do I fix CVE-2018-3809?
Upgrade serve to 7.0.0 or later.
Is CVE-2018-3809 being exploited?
There is no known exploitation of CVE-2018-3809 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-686g-3xr3-x4x6.