CVE-2015-5688: Directory Traversal in geddy
Summary
CVE-2015-5688: Directory Traversal in geddy. Affects geddy versions < 13.0.8. Fixed in 13.0.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Geddy is an npm package that provides a web framework for Node.js applications. It offers a range of features and tools to simplify the development of web applications. However, versions 13.0.8 and earlier of geddy are vulnerable to a directory traversal attack. This vulnerability allows an attacker to manipulate the URI and access files outside of the intended directory.
Vulnerability Detail
The directory traversal vulnerability in geddy arises from inadequate input validation. By using URI encoded attack vectors, an attacker can bypass security measures and traverse directories to access sensitive files. This can lead to unauthorized disclosure of information, including system files such as /etc/passwd. The vulnerability has a high severity rating and is classified under CWE-22.
How To Fix
Minimum fixed version
13.0.8
This is the first release that contains the fix.
npm install geddy@13.0.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to update geddy to the fixed version.
Conclusion
In conclusion, the directory traversal vulnerability in geddy can be exploited to access sensitive files outside of the intended directory. To mitigate this vulnerability, it is crucial to update geddy to version 13.0.8 or higher. For additional support and information on vulnerability remediation, please reach out to DevNack.com.
See every vulnerability recorded for geddy →
FAQ
The vulnerability allows an attacker to access sensitive files outside of the intended directory, potentially leading to unauthorized disclosure of information.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file to the playground and it will alert you in real-time if the vulnerability is present.
While specific exploits may not be mentioned, the directory traversal vulnerability can be exploited by manipulating the URI to access sensitive files outside of the intended directory.
Yes, this vulnerability is identified as CVE-2015-5688.
For further support on vulnerability remediation, you can contact info@devnack.com.
