CVE-2015-8859: Infoleak
Published Jan 23, 2017
·Updated
The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors.
Other sources
Versions of send prior to 0.11.2 are affected by an information leakage vulnerability which may allow an attacker to enumerate paths on the server filesystem.
Recommendation
Update to version 0.11.1 or later.
Affected Software
2 affected componentsFixes available
Send Project Send Node.js<0.11.1
npm/send<0.11.1
0.11.1
Remediation
Patch Available
Event History
Jan 23, 2017
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Data Sourced
via NVD·09:59 PM
RemedyDescriptionSeverityAffected Software
Oct 24, 2017
Advisory Published
06:33 PM
Frequently Asked Questions
1
What is the severity of CVE-2015-8859?
CVE-2015-8859 is classified as a low severity information leakage vulnerability.
2
How do I fix CVE-2015-8859?
To fix CVE-2015-8859, update the send package to version 0.11.2 or later.
3
What does CVE-2015-8859 affect?
CVE-2015-8859 affects versions of the send package prior to 0.11.2 in Node.js applications.
4
What type of vulnerability is CVE-2015-8859?
CVE-2015-8859 is an information leakage vulnerability.
5
Can CVE-2015-8859 lead to path enumeration?
Yes, CVE-2015-8859 may allow an attacker to enumerate paths on the server filesystem.