CVE-2024-31207CWE-200CWE-284

Vite's `server.fs.deny` did not deny requests for patterns with directories

Medium · published April 4, 2024

CVSS v3.1
5.9
EPSS
1%
Percentile
53.0
In the wild
Unconfirmed
What it is

Vite (French word for "quick", pronounced /vit/, like "veet") is a frontend build tooling to improve the frontend development experience.`server.fs.deny` does not deny requests for patterns with directories. This vulnerability has been patched in version(s) 5.2.6, 5.1.7, 5.0.13, 4.5.3, 3.2.10 and 2.9.18.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00711 · 53.0th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-284 · Improper Access Control
Published
2024-04-04T15:51Z
EPSS history
Timeline
  • 04 APR 15:51Z
    Vite's `server.fs.deny` did not deny requests for patterns with directories
    cvelistv5