CVE-2017-16877: Path Traversal
Published Nov 17, 2017
·Updated
Next.js before 2.4.1 has directory traversal under the /next and /static request namespace, allowing attackers to obtain sensitive information.
Other sources
ZEIT Next.js before 2.4.1 has directory traversal under the /next and /static request namespace, allowing attackers to obtain sensitive information.
Affected Software
2 affected componentsFixes available
npm/next>=1.0.0<2.4.1
2.4.1
ZEIT Next.js<2.4.1
Event History
Nov 17, 2017
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Dec 5, 2017
Advisory Published
via GitHub·02:04 AM
Frequently Asked Questions
1
What is the severity of CVE-2017-16877?
CVE-2017-16877 is considered a moderate severity vulnerability due to its potential to expose sensitive information.
2
How do I fix CVE-2017-16877?
To fix CVE-2017-16877, upgrade Next.js to version 2.4.1 or later.
3
What does CVE-2017-16877 exploit?
CVE-2017-16877 exploits directory traversal vulnerabilities in the /_next and /static request namespaces.
4
What can attackers gain from CVE-2017-16877?
Attackers can use CVE-2017-16877 to access sensitive information that should be restricted.
5
Which versions of Next.js are affected by CVE-2017-16877?
Versions of Next.js prior to 2.4.1 are affected by CVE-2017-16877.