CVE-2014-6394

Description

visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which allows remote attackers to access restricted directories, as demonstrated using public-restricted under a public directory.

Risk Information

Base Score

7.5

MODERATE

Vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score

Exploitation Probability

4.842

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2014-6394,CVE-2015-0248,CVE-2015-0251,CVE-2015-7030 are affected in Command Line Tools for XCode for Mac 7.0	Mac
Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) Vulnerability (CVE-2014-6394)	NCM

Patch Details

Click to see the patches provided by ManageEngine for this CVE

Patch ID	Patch Description
PATCH-607901	Command Line Tools for XCode for Mac 15.3 (Deployment-Only)

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234