[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cve-CVE-2017-16187":3},{"id":4,"cve_id":5,"euvd_id":6,"summary":7,"published":8,"cvss_data":9,"is_remote":19,"cwes":20,"cpes":22,"technologies":29,"references":32,"score":38,"epss_score":39,"epss_percentile":40,"is_kev":41,"cisa_kev_date_added":42,"cisa_kev_due_date":42,"cisa_ssvc":43,"attack_mappings":49,"exploits":56},211641,"CVE-2017-16187","EUVD-2018-0290","Directory Traversal in open-device\n\nAffected versions of `open-device` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.\n\n**Example request:**\n```http\nGET \u002F..\u002F..\u002F..\u002F..\u002F..\u002F..\u002F..\u002F..\u002F..\u002F..\u002Fetc\u002Fpasswd HTTP\u002F1.1\nhost:foo\n```\n\n\n## Recommendation\n\nNo patch is available for this vulnerability.\n\nIt is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.","2018-07-23T20:41:00Z",{"cvss_v3.0":10},{"scope":11,"version":12,"baseScore":13,"attackVector":14,"baseSeverity":15,"vectorString":16,"integrityImpact":17,"userInteraction":17,"attackComplexity":18,"availabilityImpact":17,"privilegesRequired":17,"confidentialityImpact":15},"UNCHANGED","3.0",7.5,"NETWORK","HIGH","CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N","NONE","LOW",true,[21],"CWE-22",[23,24,25,26,27,28],"cpe:2.3:a:open-device_project:open-device:2.0.0:*:*:*:*:node.js:*:*","cpe:2.3:a:open-device_project:open-device:1.0.0:*:*:*:*:node.js:*:*","cpe:2.3:a:open-device_project:open-device:4.0.0:*:*:*:*:node.js:*:*","cpe:2.3:a:open-device_project:open-device:4.0.1:*:*:*:*:node.js:*:*","cpe:2.3:a:open-device:open-device:4.0.1:*:*:*:*:*:*:*","cpe:2.3:a:open-device:open-device:*:*:*:*:*:*:*:*",[30,31],"Open-Device_Project Open-Device","Open-Device Open-Device",[33,34,35,36,37],"https:\u002F\u002Fgithub.com\u002FJacksonGL\u002FNPM-Vuln-PoC\u002Fblob\u002Fmaster\u002Fdirectory-traversal\u002Fopen-device","https:\u002F\u002Fnodesecurity.io\u002Fadvisories\u002F447","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2017-16187","https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-jpjp-vxv6-59hm","https:\u002F\u002Fwww.npmjs.com\u002Fadvisories\u002F447",0.73,0.01974,0.80338,false,null,{"timestamp":42,"automatable":44,"tech_impact":45,"exploitation":46,"cisa_decision":47,"cisa_remediation_timeline":48},"no","partial","none",{},"FSU",[50],{"name":51,"source":52,"tactics":53,"technique_id":55},"Exploit Public-Facing Application","attack_vector",[54],"initial-access","T1190",[57],{"link":33}]