{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/53362?format=json","vulnerability_id":"VCID-jcts-2k59-uyeb","summary":"Unauthorized File Access in node-git-server\nVersions of `node-git-server` are vulnerable to Unauthorized File Access. It is possible to access any git repository by using absolute paths, which may allow attackers to access private repositories. Upgrade to or later.","aliases":[{"alias":"GHSA-cv3v-7846-6pxm"},{"alias":"GMS-2020-405"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/78415?format=json","purl":"pkg:npm/node-git-server@0.6.1","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/node-git-server@0.6.1"}],"affected_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/270316?format=json","purl":"pkg:npm/node-git-server@0.0.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-jcts-2k59-uyeb"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/node-git-server@0.0.0"},{"url":"http://public2.vulnerablecode.io/api/packages/270317?format=json","purl":"pkg:npm/node-git-server@0.0.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-jcts-2k59-uyeb"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/node-git-server@0.0.1"},{"url":"http://public2.vulnerablecode.io/api/packages/270318?format=json","purl":"pkg:npm/node-git-server@0.0.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-jcts-2k59-uyeb"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/node-git-server@0.0.2"},{"url":"http://public2.vulnerablecode.io/api/packages/270319?format=json","purl":"pkg:npm/node-git-server@0.0.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-jcts-2k59-uyeb"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/node-git-server@0.0.3"},{"url":"http://public2.vulnerablecode.io/api/packages/270320?format=json","purl":"pkg:npm/node-git-server@0.1.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-jcts-2k59-uyeb"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/node-git-server@0.1.0"},{"url":"http://public2.vulnerablecode.io/api/packages/270321?format=json","purl":"pkg:npm/node-git-server@0.2.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-jcts-2k59-uyeb"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/node-git-server@0.2.0"},{"url":"http://public2.vulnerablecode.io/api/packages/270322?format=json","purl":"pkg:npm/node-git-server@0.2.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-jcts-2k59-uyeb"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/node-git-server@0.2.1"},{"url":"http://public2.vulnerablecode.io/api/packages/270323?format=json","purl":"pkg:npm/node-git-server@0.3.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-jcts-2k59-uyeb"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/node-git-server@0.3.0"},{"url":"http://public2.vulnerablecode.io/api/packages/270324?format=json","purl":"pkg:npm/node-git-server@0.3.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-jcts-2k59-uyeb"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/node-git-server@0.3.1"},{"url":"http://public2.vulnerablecode.io/api/packages/270325?format=json","purl":"pkg:npm/node-git-server@0.3.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-jcts-2k59-uyeb"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/node-git-server@0.3.2"},{"url":"http://public2.vulnerablecode.io/api/packages/270326?format=json","purl":"pkg:npm/node-git-server@0.3.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-jcts-2k59-uyeb"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/node-git-server@0.3.3"},{"url":"http://public2.vulnerablecode.io/api/packages/270327?format=json","purl":"pkg:npm/node-git-server@0.3.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-jcts-2k59-uyeb"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/node-git-server@0.3.4"},{"url":"http://public2.vulnerablecode.io/api/packages/270328?format=json","purl":"pkg:npm/node-git-server@0.4.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-jcts-2k59-uyeb"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/node-git-server@0.4.0"},{"url":"http://public2.vulnerablecode.io/api/packages/270329?format=json","purl":"pkg:npm/node-git-server@0.4.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-jcts-2k59-uyeb"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/node-git-server@0.4.1"},{"url":"http://public2.vulnerablecode.io/api/packages/270330?format=json","purl":"pkg:npm/node-git-server@0.4.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-jcts-2k59-uyeb"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/node-git-server@0.4.2"},{"url":"http://public2.vulnerablecode.io/api/packages/270331?format=json","purl":"pkg:npm/node-git-server@0.4.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-jcts-2k59-uyeb"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/node-git-server@0.4.3"},{"url":"http://public2.vulnerablecode.io/api/packages/270332?format=json","purl":"pkg:npm/node-git-server@0.5.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-jcts-2k59-uyeb"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/node-git-server@0.5.0"},{"url":"http://public2.vulnerablecode.io/api/packages/270333?format=json","purl":"pkg:npm/node-git-server@0.5.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-jcts-2k59-uyeb"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/node-git-server@0.5.1"},{"url":"http://public2.vulnerablecode.io/api/packages/270334?format=json","purl":"pkg:npm/node-git-server@0.6.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-jcts-2k59-uyeb"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/node-git-server@0.6.0"}],"references":[{"reference_url":"https://github.com/gabrielcsapo/node-git-server","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/gabrielcsapo/node-git-server"},{"reference_url":"https://github.com/gabrielcsapo/node-git-server/commit/ac26650f69bc445d71e4f2c55328676d10a4be43","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/gabrielcsapo/node-git-server/commit/ac26650f69bc445d71e4f2c55328676d10a4be43"},{"reference_url":"https://github.com/gabrielcsapo/node-git-server/pull/62","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/gabrielcsapo/node-git-server/pull/62"},{"reference_url":"https://snyk.io/vuln/SNYK-JS-NODEGITSERVER-474343","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://snyk.io/vuln/SNYK-JS-NODEGITSERVER-474343"},{"reference_url":"https://www.npmjs.com/advisories/1214","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.npmjs.com/advisories/1214"},{"reference_url":"https://github.com/advisories/GHSA-cv3v-7846-6pxm","reference_id":"GHSA-cv3v-7846-6pxm","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-cv3v-7846-6pxm"}],"weaknesses":[{"cwe_id":1035,"name":"OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities","description":"Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017."},{"cwe_id":937,"name":"OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities","description":"Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013."},{"cwe_id":552,"name":"Files or Directories Accessible to External Parties","description":"The product makes files or directories accessible to unauthorized actors, even though they should not be."}],"exploits":[],"severity_range_score":"7.0 - 8.9","exploitability":null,"weighted_severity":null,"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-jcts-2k59-uyeb"}