CVE-2020-36651 youngerheart nodeserver nodeserver.js path traversal
An attacker can exploit a path traversal vulnerability in youngerheart nodeserver to read arbitrary files from the server.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-36651?
CVE-2020-36651 is a medium-severity path traversal vulnerability in youngerheart nodeserver, published on 18 Jan 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability has been found in youngerheart nodeserver and classified as critical. Affected by this vulnerability is an unknown functionality of the file nodeserver.js. The manipulation leads to path traversal. The identifier of the patch is c4c0f0138ab5afbac58e03915d446680421bde28. It is recommended to apply a patch to fix this issue. The identifier VDB-218461 was assigned to this vulnerability.
Weakness: CWE-22
Which versions are affected by CVE-2020-36651?
2 open source packages ship an affected version, including web-node-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
web-node-server npm | All versions | 0.0.11 |
web-node-server npm | All versions | 0.0.11 |
Products include Nodeserver Project Nodeserver.
How do I fix CVE-2020-36651?
Upgrade web-node-server to 0.0.11 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2020-36651 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-36651 exists.
Sources
Also known as GHSA-3fwq-qv5v-2wxf.