Search criteria

3 vulnerabilities found for lite-dev-server by lite-dev-server_project

CVE-2022-25895 (GCVE-0-2022-25895)

Vulnerability from cvelistv5 – Published: 2022-12-21 23:14 – Updated: 2025-04-16 18:32
VLAI
Title
Directory Traversal
Summary
All versions of package lite-dev-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed to the req.url user input that is passed to the server code.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P
CWE
  • Directory Traversal
Assigner
References
Impacted products
Vendor Product Version
n/a lite-dev-server Affected: 0 , < unspecified (custom)
Date Public
2022-12-21 00:00
Credits
Liran Tal Snyk
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T04:49:44.151Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.snyk.io/vuln/SNYK-JS-LITEDEVSERVER-3153718"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/shadowwzw/lite-dev-server/blob/master/src/server.js%23L134"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://gist.github.com/lirantal/0f8a48c3f5ac581ce73123abe9f7f120"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-25895",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-16T18:32:44.183274Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-22",
                "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-16T18:32:59.442Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "lite-dev-server",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Liran Tal"
        },
        {
          "lang": "en",
          "value": "Snyk"
        }
      ],
      "datePublic": "2022-12-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "All versions of package lite-dev-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed to the req.url user input that is passed to the server code."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "remediationLevel": "NOT_DEFINED",
            "reportConfidence": "NOT_DEFINED",
            "scope": "UNCHANGED",
            "temporalScore": 7.1,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Directory Traversal",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-21T00:00:00.000Z",
        "orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
        "shortName": "snyk"
      },
      "references": [
        {
          "url": "https://security.snyk.io/vuln/SNYK-JS-LITEDEVSERVER-3153718"
        },
        {
          "url": "https://github.com/shadowwzw/lite-dev-server/blob/master/src/server.js%23L134"
        },
        {
          "url": "https://gist.github.com/lirantal/0f8a48c3f5ac581ce73123abe9f7f120"
        }
      ],
      "title": "Directory Traversal"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
    "assignerShortName": "snyk",
    "cveId": "CVE-2022-25895",
    "datePublished": "2022-12-21T23:14:33.786Z",
    "dateReserved": "2022-02-24T00:00:00.000Z",
    "dateUpdated": "2025-04-16T18:32:59.442Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-25895 (GCVE-0-2022-25895)

Vulnerability from nvd – Published: 2022-12-21 23:14 – Updated: 2025-04-16 18:32
VLAI
Title
Directory Traversal
Summary
All versions of package lite-dev-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed to the req.url user input that is passed to the server code.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P
CWE
  • Directory Traversal
Assigner
References
Impacted products
Vendor Product Version
n/a lite-dev-server Affected: 0 , < unspecified (custom)
Date Public
2022-12-21 00:00
Credits
Liran Tal Snyk
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T04:49:44.151Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.snyk.io/vuln/SNYK-JS-LITEDEVSERVER-3153718"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/shadowwzw/lite-dev-server/blob/master/src/server.js%23L134"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://gist.github.com/lirantal/0f8a48c3f5ac581ce73123abe9f7f120"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-25895",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-16T18:32:44.183274Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-22",
                "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-16T18:32:59.442Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "lite-dev-server",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Liran Tal"
        },
        {
          "lang": "en",
          "value": "Snyk"
        }
      ],
      "datePublic": "2022-12-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "All versions of package lite-dev-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed to the req.url user input that is passed to the server code."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "remediationLevel": "NOT_DEFINED",
            "reportConfidence": "NOT_DEFINED",
            "scope": "UNCHANGED",
            "temporalScore": 7.1,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Directory Traversal",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-21T00:00:00.000Z",
        "orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
        "shortName": "snyk"
      },
      "references": [
        {
          "url": "https://security.snyk.io/vuln/SNYK-JS-LITEDEVSERVER-3153718"
        },
        {
          "url": "https://github.com/shadowwzw/lite-dev-server/blob/master/src/server.js%23L134"
        },
        {
          "url": "https://gist.github.com/lirantal/0f8a48c3f5ac581ce73123abe9f7f120"
        }
      ],
      "title": "Directory Traversal"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
    "assignerShortName": "snyk",
    "cveId": "CVE-2022-25895",
    "datePublished": "2022-12-21T23:14:33.786Z",
    "dateReserved": "2022-02-24T00:00:00.000Z",
    "dateUpdated": "2025-04-16T18:32:59.442Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

FKIE_CVE-2022-25895

Vulnerability from fkie_nvd - Published: 2022-12-21 05:15 - Updated: 2025-04-16 19:15
Severity
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
All versions of package lite-dev-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed to the req.url user input that is passed to the server code.
References
report@snyk.iohttps://gist.github.com/lirantal/0f8a48c3f5ac581ce73123abe9f7f120Exploit, Third Party Advisory
report@snyk.iohttps://github.com/shadowwzw/lite-dev-server/blob/master/src/server.js%23L134Broken Link
report@snyk.iohttps://security.snyk.io/vuln/SNYK-JS-LITEDEVSERVER-3153718Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://gist.github.com/lirantal/0f8a48c3f5ac581ce73123abe9f7f120Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/shadowwzw/lite-dev-server/blob/master/src/server.js%23L134Broken Link
af854a3a-2127-422b-91ae-364da2661108https://security.snyk.io/vuln/SNYK-JS-LITEDEVSERVER-3153718Exploit, Third Party Advisory
Impacted products
Vendor Product Version
lite-dev-server_project lite-dev-server -
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:lite-dev-server_project:lite-dev-server:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "68B7B5D5-58B7-416D-82FE-05A17FF24FE7",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "All versions of package lite-dev-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed to the req.url user input that is passed to the server code."
    },
    {
      "lang": "es",
      "value": "Todas las versiones del paquete lite-dev-server son vulnerables a Directory Traversal debido a la falta de sanitizaci\u00f3n de entrada y al uso de entornos sandbox para la entrada del usuario req.url que se pasa al c\u00f3digo del servidor."
    }
  ],
  "id": "CVE-2022-25895",
  "lastModified": "2025-04-16T19:15:45.103",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "report@snyk.io",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-12-21T05:15:11.313",
  "references": [
    {
      "source": "report@snyk.io",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://gist.github.com/lirantal/0f8a48c3f5ac581ce73123abe9f7f120"
    },
    {
      "source": "report@snyk.io",
      "tags": [
        "Broken Link"
      ],
      "url": "https://github.com/shadowwzw/lite-dev-server/blob/master/src/server.js%23L134"
    },
    {
      "source": "report@snyk.io",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://security.snyk.io/vuln/SNYK-JS-LITEDEVSERVER-3153718"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://gist.github.com/lirantal/0f8a48c3f5ac581ce73123abe9f7f120"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link"
      ],
      "url": "https://github.com/shadowwzw/lite-dev-server/blob/master/src/server.js%23L134"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://security.snyk.io/vuln/SNYK-JS-LITEDEVSERVER-3153718"
    }
  ],
  "sourceIdentifier": "report@snyk.io",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}