NVD

Id
33909  
Name
CVE-2014-6394  
Description
visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which allows remote attackers to access restricted directories, as demonstrated using "public-restricted" under a "public" directory.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2014-10-08  
Modified Date
2017-01-06  
Seq
2014-6394  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
175936 33909 CVE-2014-6394 APPLE-SA-2015-09-16-2  View
175937 33909 CVE-2014-6394 FEDORA-2014-11495  View
175938 33909 CVE-2014-6394 FEDORA-2014-11421  View
175939 33909 CVE-2014-6394 FEDORA-2014-11289  View
175940 33909 CVE-2014-6394 62170  View
175941 33909 CVE-2014-6394 http://www-01.ibm.com/support/docview.wss?uid=swg21687263  View
175942 33909 CVE-2014-6394 [oss-security] 20140924 CVE request: various NodeJS module vulnerabilities  View
175943 33909 CVE-2014-6394 [oss-security] 20140924 Re: CVE request: various NodeJS module vulnerabilities  View
175944 33909 CVE-2014-6394 70100  View
175945 33909 CVE-2014-6394 nodejs-cve20146394-dir-traversal(96727)  View
175946 33909 CVE-2014-6394 https://bugzilla.redhat.com/show_bug.cgi?id=1146063  View
175947 33909 CVE-2014-6394 https://github.com/visionmedia/send/commit/9c6ca9b2c0b880afd3ff91ce0d211213c5fa5f9a  View
175948 33909 CVE-2014-6394 https://github.com/visionmedia/send/pull/59  View
175949 33909 CVE-2014-6394 https://nodesecurity.io/advisories/send-directory-traversal  View
175950 33909 CVE-2014-6394 https://support.apple.com/HT205217  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
15749 JVNDB-2014-004624 Node.js 用 visionmedia send における制限されたディレクトリにアクセスされる脆弱性 Node.js 用 visionmedia send は、ディレクトリがドキュメントルート内にあるかどうかの検証に部分比較を使用するため、制限されたディレクトリにアクセスされる脆弱性が存在します。 CVE-2014-6394 73686 CVE-2014-6394 33909 7.5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-004624.html 2014-09-05 2015-10-05 View