CVE-2015-8856: Cross-Site Scripting in serve-index
Summary
CVE-2015-8856: Cross-Site Scripting in serve-index. Affects serve-index versions < 1.6.3. Fixed in 1.6.3. How to fix ↓
Also tracked for
- node-serve-index · Debian:11
The same CVE-2015-8856 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The serve-index package is an npm module that provides a middleware for serving directory listings. It generates HTML output to display the contents of a directory, including file and directory names. However, versions 1.6.2 and earlier of serve-index are vulnerable to a cross-site scripting (XSS) attack. This vulnerability arises from the lack of proper escaping of file and directory names in the module's HTML output. An attacker who can control or influence the names of files or directories can exploit this vulnerability to launch a persistent XSS attack on the application.
Vulnerability Detail
The cross-site scripting vulnerability in serve-index allows an attacker to inject malicious scripts into the HTML output. This can lead to various consequences, such as stealing sensitive user information, performing unauthorized actions on behalf of the user, or defacing the application's web pages. The vulnerability is considered moderate in severity with a CVSS score of 6.1. The CWE ID associated with this vulnerability is CWE-79.
How To Fix
Minimum fixed version
1.6.3
This is the first release that contains the fix.
npm install serve-index@1.6.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The serve-index package, versions 1.6.2 and earlier, is vulnerable to a cross-site scripting attack. It is recommended to update to version 1.6.3 or later to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for serve-index →
FAQ
serve-index is an npm module that provides a middleware for serving directory listings. It generates HTML output to display the contents of a directory.
Cross-site scripting is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to various attacks, such as stealing sensitive information or performing unauthorized actions on behalf of the user.
The serve-index vulnerability allows an attacker to inject malicious scripts into the HTML output, potentially leading to the compromise of user data, unauthorized actions, or defacement of web pages.
The vulnerability is considered moderate in severity with a CVSS score of 6.1.
To fix the vulnerability, update serve-index to version 1.6.3 or later, which includes the necessary fixes to prevent cross-site scripting attacks.
