Quick answers
- Is CVE-2018-16479 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2018-16479 being exploited in the wild.
- How severe is CVE-2018-16479?
- Informational severity, with a CVSS score of 7.5, published 7 February 2019.
- Which products and versions are affected?
- http-live-simulator (npm) before 1.0.7.
- Is there a fix for CVE-2018-16479?
- A patch was published on 2019: Version 1.0.7 available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2018-16479 attacked?
- It is attacked over the network.
- Am I affected by CVE-2018-16479?
- Check whether you run http-live-simulator (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a path traversal (CWE-22) caused by insufficient input sanitization of HTTP request paths. Attackers can exploit this by sending requests containing relative path sequences (e.g., "/../../../etc/passwd") to access files outside the intended directory. The attack requires network access to the server and can be performed without authentication. An attacker can read arbitrary files accessible to the server process, potentially exposing sensitive data. The fix is to upgrade to version 1.0.7 or later.
Affected products
- npm http-live-simulator before 1.0.7
Identifiers
- CVE-2018-16479
- GHSA-7c9w-qmrq-ff8r
Timeline
- 2019-02-07: disclosed
- 2019: patched: Version 1.0.7 available