Information Exposure Affecting serve-handler package, versions <5.0.8
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-SERVEHANDLER-450208
- published 7 Apr 2019
- disclosed 7 Apr 2019
- credit skyn3t
How to fix?
Upgrade serve-handler to version 5.0.8 or higher.
Overview
serve-handler is a package responsible for routing requests and handling responses.
Affected versions of this package are vulnerable to Information Exposure. The unlisted property removes the file/folder from directory list but still allows viewing them by visiting their path.
CVSS Scores
version 3.1