Installed packages are exposed by node_modules in Rendertron 1.0.0, allowing remote attackers to read absolute paths on the server by examining the "_where" attribute of package.json files.
References
Link | Resource |
---|---|
https://bugs.chromium.org/p/chromium/issues/detail?id=759111 | Exploit Issue Tracking Vendor Advisory |
https://github.com/GoogleChrome/rendertron/commit/8d70628c96ae72eff6eebb451d26fc9ed6b58b0e | Patch Third Party Advisory |
https://github.com/GoogleChrome/rendertron/pull/88 | Patch Third Party Advisory |
Configurations
History
No history.
Information
Published : 2018-12-17 07:29
Updated : 2024-02-04 20:03
NVD link : CVE-2017-18355
Mitre link : CVE-2017-18355
CVE.ORG link : CVE-2017-18355
JSON object : View
Products Affected
- rendertron
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor