CVE-2017-16104: Directory Traversal in citypredict.whauwiller
Summary
CVE-2017-16104: Directory Traversal in citypredict.whauwiller. Affects citypredict.whauwiller versions < 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
citypredict.whauwiller is an npm package used for local development. It provides functionality related to city prediction. However, this package is vulnerable to a directory traversal vulnerability. This means that it resolves relative file paths incorrectly, allowing a malicious actor to access files outside of the intended directory root. This can lead to the disclosure of private files on the vulnerable system.
Vulnerability Detail
The directory traversal vulnerability in citypredict.whauwiller arises from the incorrect resolution of relative file paths. By exploiting this vulnerability, an attacker can craft requests that traverse directories and access files outside of the intended directory root. For example, an attacker can send a GET request with a crafted path like GET /../../../etc/passwd to retrieve the /etc/passwd file. This can result in the exposure of sensitive information or the ability to execute further attacks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no patch available, the best workaround is to avoid using the citypredict.whauwiller package in production environments. Instead, consider finding a different package that provides similar functionality but does not have the directory traversal vulnerability.
Conclusion
The citypredict.whauwiller package is vulnerable to a directory traversal vulnerability, which can lead to the disclosure of private files on the vulnerable system. No patch is available for this vulnerability, so it is advised to only use this package for local development purposes. If the functionality is needed for production, it is recommended to find a different package that does not suffer from this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for citypredict.whauwiller →
FAQ
citypredict.whauwiller is an npm package used for local development that provides functionality related to city prediction.
A directory traversal vulnerability is a security flaw that allows an attacker to access files outside of the intended directory root by manipulating file paths.
By exploiting this vulnerability, an attacker can access sensitive files on the vulnerable system, potentially leading to the exposure of private information or the ability to execute further attacks.
No, there is no patch available for this vulnerability at the moment.
If the functionality provided by citypredict.whauwiller is required for production, it is recommended to find an alternative package that does not have the directory traversal vulnerability.
