CVE-2015-8859

CVE-2015-8859

Medium · published January 24, 2017

CVSS v3.1

5.3

EPSS

5%

Percentile

91.8

In the wild

Unconfirmed

What it is

The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors.

The record

Technical detail

CVSS v3.1: 5.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.04702 · 91.8th percentile
Published: 2017-01-24T02:59Z

Affected products (1)

Product	Versions	Fixed in
send_project/send	< 0.11.1	0.11.1

References (6)

http://www.openwall.com/lists/oss-security/2016/04/20/11 · [email protected]http://www.securityfocus.com/bid/96435 · [email protected]https://nodesecurity.io/advisories/56 · [email protected]http://www.openwall.com/lists/oss-security/2016/04/20/11 · af854a3a-2127-422b-91ae-364da2661108 http://www.securityfocus.com/bid/96435 · af854a3a-2127-422b-91ae-364da2661108 https://nodesecurity.io/advisories/56 · af854a3a-2127-422b-91ae-364da2661108

EPSS history

Timeline

23 JAN 21:00Z
The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors
cvelistv5