CVE-2015-5688

Nuclei

Directory Traversal in geddy

Title source: GitHub Advisory
STIX 2.1 vulnerability

Record summary

CVE-2015-5688 has a selected CVSS score of 5.0; EIP currently links 1 Nuclei template.

Description

Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the PATH_INFO to the default URI.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

geddy

Browse npm / geddy
GitHub AdvisoryBefore 13.0.8 · Fixed in 13.0.8affected

Nuclei templates

1
ProjectDiscoveryMEDIUMGeddy <13.0.8 - Local File InclusionCVSS 5

Geddy prior to version 13.0.8 contains a directory traversal vulnerability in lib/app/index.js that allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the PATH_INFO to the default URI.

Impact

The vulnerability can be exploited to read sensitive files, execute arbitrary code, or gain unauthorized access to the system.

Remediation

Upgrade Geddy to version 13.0.8 or later to mitigate the vulnerability.

WeaknessesCWE-22
Authorspikpikcu
Template tagscve2015cvegeddylfigeddyjsnode.jsvuln
CVSS vector: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N
CPE: cpe:2.3:a:geddyjs:geddy:13.0.7:*:*:*:*:node.js:*:*
https://nodesecurity.io/advisories/geddy-directory-traversal https://github.com/geddy/geddy/issues/697 https://github.com/geddy/geddy/commit/2de63b68b3aa6c08848f261ace550a37959ef231 https://nvd.nist.gov/vuln/detail/CVE-2015-5688 https://github.com/geddy/geddy/pull/699

Source: ProjectDiscovery

References

9