GHSA-jgqf-hwc5-hh37

Root Path Disclosure in send

Source: GitHub Advisory Database (reviewed) Moderate CVE-2015-8859

Packages

Ecosystem	Package	Affected	Fixed in
npm	send	< 0.11.1	0.11.1

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of `send` prior to 0.11.2 are affected by an information leakage vulnerability which may allow an attacker to enumerate paths on the server filesystem. ## Recommendation Update to version 0.11.1 or later.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2015-8859 advisory
https://github.com/pillarjs/send/pull/70 web
https://github.com/pillarjs/send/commit/98a5b89982b38e79db684177cf94730ce7fc7aed web
https://github.com/expressjs/serve-static/blob/master/HISTORY.md#181--2015-01-20 web
https://github.com/pillarjs/send package
https://web.archive.org/web/20200227192016/https://www.securityfocus.com/bid/96435 web
http://www.openwall.com/lists/oss-security/2016/04/20/11 web