CVE-2015-8859: Infoleak
The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors.
Other sources
Versions of send prior to 0.11.2 are affected by an information leakage vulnerability which may allow an attacker to enumerate paths on the server filesystem.
Recommendation
Update to version 0.11.1 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/sendto a version that resolves this vulnerability.Fixed in 0.11.1 - Upgrade
Upgrade
sendto a version that resolves this vulnerability.Fixed in 0.11.2
Event History
Frequently Asked Questions
What is the severity of CVE-2015-8859?
CVE-2015-8859 is classified as a low severity information leakage vulnerability.
How do I fix CVE-2015-8859?
To fix CVE-2015-8859, update the send package to version 0.11.2 or later.
What does CVE-2015-8859 affect?
CVE-2015-8859 affects versions of the send package prior to 0.11.2 in Node.js applications.
What type of vulnerability is CVE-2015-8859?
CVE-2015-8859 is an information leakage vulnerability.
Can CVE-2015-8859 lead to path enumeration?
Yes, CVE-2015-8859 may allow an attacker to enumerate paths on the server filesystem.