« Volver al listado

CVE-2018-3724

Estado: ModificadaAlta (7.5)—

general-file-server node module suffers from a Path Traversal vulnerability due to lack of validation of currpath, which allows a malicious user to read content of any file with known path.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

General-file-server Project — General-file-server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-3724",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": true,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "support@hackerone.com",
      "affectedData": [
        {
          "vendor": "HackerOne",
          "product": "general-file-server node module",
          "versions": [
            {
              "status": "affected",
              "version": "All versions"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-06-07T02:29:08.457",
  "references": [
    {
      "url": "https://hackerone.com/reports/310943",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "support@hackerone.com"
    },
    {
      "url": "https://hackerone.com/reports/310943",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "support@hackerone.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "general-file-server node module suffers from a Path Traversal vulnerability due to lack of validation of currpath, which allows a malicious user to read content of any file with known path."
    },
    {
      "lang": "es",
      "value": "El módulo de node general-file-server sufre de una vulnerabilidad de salto de directorio debido a la falta de validación de currpath, lo que permite que un usuario malicioso lea contenido de cualquier archivo con una ruta conocida."
    }
  ],
  "lastModified": "2026-06-17T01:57:43.663",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:general-file-server_project:general-file-server:1.0.0:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2D71C393-54EE-4758-A1DD-C5F1653229BD"
            },
            {
              "criteria": "cpe:2.3:a:general-file-server_project:general-file-server:1.1.2:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "430A008D-93E6-4C27-A13D-DBE56D615B48"
            },
            {
              "criteria": "cpe:2.3:a:general-file-server_project:general-file-server:1.1.3:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7AF968B1-28BC-45BF-BCD5-B81FAF6FDCA6"
            },
            {
              "criteria": "cpe:2.3:a:general-file-server_project:general-file-server:1.1.4:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "917E5609-873D-4768-A2B6-7473EBC4A244"
            },
            {
              "criteria": "cpe:2.3:a:general-file-server_project:general-file-server:1.1.5:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "02715590-7BC4-4E3E-9DD5-C0CAF23FEA1C"
            },
            {
              "criteria": "cpe:2.3:a:general-file-server_project:general-file-server:1.1.6:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CA5A71A5-C0F4-4BE9-9015-537751E44D0D"
            },
            {
              "criteria": "cpe:2.3:a:general-file-server_project:general-file-server:1.1.7:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9E3A8058-C0CB-4BB1-8BB1-B1CB51347D50"
            },
            {
              "criteria": "cpe:2.3:a:general-file-server_project:general-file-server:1.1.8:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B8701179-7B07-47F8-98F4-A72C789171DD"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "support@hackerone.com"
}