{"id":"GHSA-rch9-xh7r-mqgw","summary":"Cross-Site Scripting in connect","details":"connect node module before 2.14.0 suffers from a Cross-Site Scripting (XSS) vulnerability due to a lack of validation of file in directory.js middleware.","aliases":["CVE-2018-3717"],"modified":"2023-11-01T04:49:27.155875Z","published":"2018-07-26T15:08:05Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2020-06-16T21:54:23Z","nvd_published_at":"2018-06-07T02:29:00Z","cwe_ids":["CWE-79"]},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-3717"},{"type":"WEB","url":"https://github.com/JacksonTian/anywhere/issues/33#issuecomment-366527448"},{"type":"WEB","url":"https://github.com/senchalabs/connect/commit/6d5dd30075d2bc4ee97afdbbe3d9d98d8d52d74b"},{"type":"WEB","url":"https://hackerone.com/reports/309394"},{"type":"WEB","url":"https://hackerone.com/reports/309641"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-rch9-xh7r-mqgw"},{"type":"WEB","url":"https://www.npmjs.com/advisories/584"},{"type":"WEB","url":"https://www.npmjs.com/advisories/595"}],"affected":[{"package":{"name":"connect","ecosystem":"npm","purl":"pkg:npm/connect"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.14.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/07/GHSA-rch9-xh7r-mqgw/GHSA-rch9-xh7r-mqgw.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}