Vulnerability Instance

HTTP 200 OK
Allow: GET, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "url": "http://public2.vulnerablecode.io/api/vulnerabilities/45315?format=api",
    "vulnerability_id": "VCID-n143-1uka-s3eg",
    "summary": "Use of Incorrectly-Resolved Name or Reference\nVite provides frontend tooling. Prior to versions 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, and 4.3.9, Vite Server Options (`server.fs.deny`) can be bypassed using double forward-slash (//) allows any unauthenticated user to read file from the Vite root-path of the application including the default `fs.deny` settings (`['.env', '.env.*', '*.{crt,pem}']`). Only users explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected, and only files in the immediate Vite project root folder could be exposed. This issue is fixed in vite@4.3.9, vite@4.2.3, vite@4.1.5, vite@4.0.5, vite@3.2.7, and vite@2.9.16.",
    "aliases": [
        {
            "alias": "CVE-2023-34092"
        },
        {
            "alias": "GHSA-353f-5xf4-qw67"
        }
    ],
    "fixed_packages": [
        {
            "url": "http://public2.vulnerablecode.io/api/packages/65307?format=api",
            "purl": "pkg:npm/vite@2.9.16",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-mbnq-b7vj-jyhb"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/vite@2.9.16"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/packages/65308?format=api",
            "purl": "pkg:npm/vite@3.2.7",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-mbnq-b7vj-jyhb"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/vite@3.2.7"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/packages/65309?format=api",
            "purl": "pkg:npm/vite@4.0.5",
            "is_vulnerable": false,
            "affected_by_vulnerabilities": [],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/vite@4.0.5"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/packages/65310?format=api",
            "purl": "pkg:npm/vite@4.1.5",
            "is_vulnerable": false,
            "affected_by_vulnerabilities": [],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/vite@4.1.5"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/packages/65311?format=api",
            "purl": "pkg:npm/vite@4.2.3",
            "is_vulnerable": false,
            "affected_by_vulnerabilities": [],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/vite@4.2.3"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/packages/65312?format=api",
            "purl": "pkg:npm/vite@4.3.9",
            "is_vulnerable": false,
            "affected_by_vulnerabilities": [],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/vite@4.3.9"
        }
    ],
    "affected_packages": [
        {
            "url": "http://public2.vulnerablecode.io/api/packages/65301?format=api",
            "purl": "pkg:npm/vite@2.9.15",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-n143-1uka-s3eg"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/vite@2.9.15"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/packages/65302?format=api",
            "purl": "pkg:npm/vite@3.0.2",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-n143-1uka-s3eg"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/vite@3.0.2"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/packages/65303?format=api",
            "purl": "pkg:npm/vite@4.0.0",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-6cep-dhsy-qkhg"
                },
                {
                    "vulnerability": "VCID-ccy3-s9ra-uub9"
                },
                {
                    "vulnerability": "VCID-mbnq-b7vj-jyhb"
                },
                {
                    "vulnerability": "VCID-n143-1uka-s3eg"
                },
                {
                    "vulnerability": "VCID-vyjc-1f5b-p7cs"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/vite@4.0.0"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/packages/65304?format=api",
            "purl": "pkg:npm/vite@4.1.0",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-n143-1uka-s3eg"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/vite@4.1.0"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/packages/65305?format=api",
            "purl": "pkg:npm/vite@4.2.0",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-n143-1uka-s3eg"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/vite@4.2.0"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/packages/65306?format=api",
            "purl": "pkg:npm/vite@4.3.0",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-n143-1uka-s3eg"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/vite@4.3.0"
        }
    ],
    "references": [
        {
            "reference_url": "https://github.com/vitejs/vite/commit/813ddd6155c3d54801e264ba832d8347f6f66b32",
            "reference_id": "",
            "reference_type": "",
            "scores": [],
            "url": "https://github.com/vitejs/vite/commit/813ddd6155c3d54801e264ba832d8347f6f66b32"
        },
        {
            "reference_url": "https://github.com/vitejs/vite/pull/13348",
            "reference_id": "",
            "reference_type": "",
            "scores": [],
            "url": "https://github.com/vitejs/vite/pull/13348"
        },
        {
            "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34092",
            "reference_id": "CVE-2023-34092",
            "reference_type": "",
            "scores": [],
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34092"
        },
        {
            "reference_url": "https://github.com/vitejs/vite/security/advisories/GHSA-353f-5xf4-qw67",
            "reference_id": "GHSA-353f-5xf4-qw67",
            "reference_type": "",
            "scores": [],
            "url": "https://github.com/vitejs/vite/security/advisories/GHSA-353f-5xf4-qw67"
        }
    ],
    "weaknesses": [
        {
            "cwe_id": 1035,
            "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities",
            "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017."
        },
        {
            "cwe_id": 706,
            "name": "Use of Incorrectly-Resolved Name or Reference",
            "description": "The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere."
        },
        {
            "cwe_id": 937,
            "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities",
            "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013."
        }
    ],
    "exploits": [],
    "severity_range_score": null,
    "exploitability": null,
    "weighted_severity": null,
    "risk_score": null,
    "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-n143-1uka-s3eg"
}