serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded.

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• zeit servebefore 6.5.2

Versions reported by the vendor

Affected version ranges reported by the assigning authority (hackerone). Independent of NVD's CPE analysis and usually ahead of it.

• HackerOne serve node module

  • All versionsaffected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2019-5417A path traversal vulnerability in serve npm package version 7.0.1 allows the attackers to read content of arbitrary files on the remote serv
  31Monitor
• CVE-2019-5415A bug in handling the ignore files and directories feature in serve 6.5.3 allows an attacker to read a file or list the directory that the v
  30Monitor
• CVE-2018-3712serve node module before 6.4.9 suffers from a Path Traversal vulnerability due to not handling %2e (.) and %2f (/) and allowing them in path
  27Monitor
• CVE-2018-3809Information exposure through directory listings in serve 6.5.3 allows directory listing and file access even when they have been set to be i
  21Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.