CVE-2017-16110: Directory Traversal in weather.swlyons
Summary
CVE-2017-16110: Directory Traversal in weather.swlyons. Affects weather.swlyons versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The weather.swlyons package is an npm package used for weather-related functionality. It provides features for retrieving weather information based on location. However, this package is vulnerable to a directory traversal vulnerability, which allows an attacker to access files outside of the intended directory root.
Vulnerability Detail
The vulnerability arises from the package's resolution of relative file paths. By manipulating the file path in a specific way, a malicious actor can traverse directories and access files that should be restricted. This can lead to the disclosure of sensitive files on the vulnerable system. An example request that demonstrates this vulnerability is:
GET /../../../etc/passwd HTTP/1.1
host: foo
This vulnerability has a high severity level and is classified under CWE-22.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no patch available, the only workaround is to avoid using the weather.swlyons package in production environments. Instead, consider using a different package that provides similar weather functionality but does not have the directory traversal vulnerability.
Conclusion
The weather.swlyons package is vulnerable to a directory traversal vulnerability, which can result in the disclosure of sensitive files. It is advised to only use this package for local development and to find an alternative package for production environments. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for weather.swlyons →
FAQ
The vulnerability allows an attacker to access files outside of the intended directory root, potentially leading to the disclosure of sensitive information.
No, there is no patch available for this vulnerability.
Yes, the package can still be used for local development purposes.
It is recommended to use a different package that provides weather functionality but does not have the directory traversal vulnerability.
There are no known exploits for this vulnerability at the moment.
