CVE-2018-11798

Published: Jan 7, 2019Modified: Nov 21, 2024

6.5

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path.

Affected (1)

Products: Apache: Thrift

Apache

1 product

Thrift

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Thrift	From 0.9.2 to 0.11.0

Related CWEs

CWE-538

Insertion of Sensitive Information into Externally-Accessible File or Directory

The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.

References (10)

http://www.securityfocus.com/bid/106501

Source: security@apache.org

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHSA-2019:1545

Source: security@apache.org

https://access.redhat.com/errata/RHSA-2019:3140

Source: security@apache.org

https://lists.apache.org/thread.html/6e9edd282684896cedf615fb67a02bebfe6007f2d5baf03ba52e34fd%40%3Cuser.thrift.apache.org%3E

Source: security@apache.org

https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

Source: security@apache.org

http://www.securityfocus.com/bid/106501