Vulnerability-Lookup

CVE-2015-8859 (GCVE-0-2015-8859)

Vulnerability from cvelistv5 – Published: 2017-01-23 21:00 – Updated: 2024-08-06 08:29

Summary

The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE

Assigner

mitre mitre root Scorecard

References

3 references

URL	Tags
http://www.securityfocus.com/bid/96435	vdb-entryx_refsource_BID
https://nodesecurity.io/advisories/56	x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2016/0…	mailing-listx_refsource_MLIST

Date Public

2015-11-03 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T08:29:22.044Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "96435",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/96435"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://nodesecurity.io/advisories/56"
          },
          {
            "name": "[oss-security] 20160420 various vulnerabilities in Node.js packages",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/04/20/11"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-11-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-03-01T10:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "96435",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/96435"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://nodesecurity.io/advisories/56"
        },
        {
          "name": "[oss-security] 20160420 various vulnerabilities in Node.js packages",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/04/20/11"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2015-8859",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "96435",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/96435"
            },
            {
              "name": "https://nodesecurity.io/advisories/56",
              "refsource": "CONFIRM",
              "url": "https://nodesecurity.io/advisories/56"
            },
            {
              "name": "[oss-security] 20160420 various vulnerabilities in Node.js packages",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2016/04/20/11"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2015-8859",
    "datePublished": "2017-01-23T21:00:00.000Z",
    "dateReserved": "2016-04-20T00:00:00.000Z",
    "dateUpdated": "2024-08-06T08:29:22.044Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2015-8859",
      "date": "2026-10-05",
      "epss": "0.04702",
      "percentile": "0.91538"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:send_project:send:*:*:*:*:*:node.js:*:*",
                  "matchCriteriaId": "E3AD6A79-80D5-4F94-9768-6914D8E9A13B",
                  "versionEndExcluding": "0.11.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors."
        },
        {
          "lang": "es",
          "value": "El paquete send en versiones anteriores a 0.11.1 para Node.js permite a atacantes obter la ruta de root a trav\u00e9s de vectores no especificados."
        }
      ],
      "id": "CVE-2015-8859",
      "lastModified": "2024-11-21T02:39:20.007",
      "metrics": {
        "cvssMetricV2": [
          {
            "acInsufInfo": true,
            "baseSeverity": "MEDIUM",
            "cvssData": {
              "accessComplexity": "LOW",
              "accessVector": "NETWORK",
              "authentication": "NONE",
              "availabilityImpact": "NONE",
              "baseScore": 5.0,
              "confidentialityImpact": "PARTIAL",
              "integrityImpact": "NONE",
              "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
              "version": "2.0"
            },
            "exploitabilityScore": 10.0,
            "impactScore": 2.9,
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "source": "nvd@nist.gov",
            "type": "Primary",
            "userInteractionRequired": false
          }
        ],
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            },
            "exploitabilityScore": 3.9,
            "impactScore": 1.4,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2017-01-23T21:59:00.657",
      "references": [
        {
          "source": "cve@mitre.org",
          "tags": [
            "Mailing List",
            "Third Party Advisory"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/04/20/11"
        },
        {
          "source": "cve@mitre.org",
          "tags": [
            "Broken Link",
            "Third Party Advisory",
            "VDB Entry"
          ],
          "url": "http://www.securityfocus.com/bid/96435"
        },
        {
          "source": "cve@mitre.org",
          "tags": [
            "Broken Link",
            "Patch",
            "Vendor Advisory"
          ],
          "url": "https://nodesecurity.io/advisories/56"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Mailing List",
            "Third Party Advisory"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/04/20/11"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Broken Link",
            "Third Party Advisory",
            "VDB Entry"
          ],
          "url": "http://www.securityfocus.com/bid/96435"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Broken Link",
            "Patch",
            "Vendor Advisory"
          ],
          "url": "https://nodesecurity.io/advisories/56"
        }
      ],
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "NVD-CWE-noinfo"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:send_project:send:*:*:*:*:*:node.js:*:*",
                    "matchCriteriaId": "E3AD6A79-80D5-4F94-9768-6914D8E9A13B",
                    "versionEndExcluding": "0.11.1",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors."
          },
          {
            "lang": "es",
            "value": "El paquete send en versiones anteriores a 0.11.1 para Node.js permite a atacantes obter la ruta de root a trav\u00e9s de vectores no especificados."
          }
        ],
        "id": "CVE-2015-8859",
        "lastModified": "2026-05-13T00:24:29.033",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": true,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "NONE",
                "baseScore": 5.0,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "NONE",
                "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                "version": "2.0"
              },
              "exploitabilityScore": 10.0,
              "impactScore": 2.9,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 1.4,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2017-01-23T21:59:00.657",
        "references": [
          {
            "source": "cve@mitre.org",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/04/20/11"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Broken Link",
              "Third Party Advisory",
              "VDB Entry"
            ],
            "url": "http://www.securityfocus.com/bid/96435"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Broken Link",
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://nodesecurity.io/advisories/56"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/04/20/11"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Broken Link",
              "Third Party Advisory",
              "VDB Entry"
            ],
            "url": "http://www.securityfocus.com/bid/96435"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Broken Link",
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://nodesecurity.io/advisories/56"
          }
        ],
        "sourceIdentifier": "cve@mitre.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-11-21T15:13:20+00:00",
      "cve": "CVE-2015-8859",
      "id": "CVE-2015-8859",
      "initial_release_date": "2015-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "nodejs-send: sensitive information disclosure",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2015/cve-2015-8859.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "critical",
      "current_release_date": "2025-04-20T23:27:16Z",
      "cve": "CVE-2015-8859",
      "id": "CVE-2015-8859",
      "initial_release_date": "2023-02-15T05:10:44Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2015-8859",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2015-8859.json",
      "version": "3"
    }
  }
}

CNVD-2016-02538

Vulnerability from cnvd - Published: 2016-04-26

Title

Joyent Node.js send ROOT目录发现漏洞

Description

Joyent Node.js是美一套建立在Google V8 JavaScript引擎之上的网络应用平台。 Joyent Node.js send存在安全漏洞，允许远程攻击者可提交提交特殊的请求发现root目录。

Severity

中

Patch Name

Joyent Node.js send ROOT目录发现漏洞的补丁

Patch Description

Joyent Node.js是美一套建立在Google V8 JavaScript引擎之上的网络应用平台。 Joyent Node.js send存在安全漏洞，允许远程攻击者可提交提交特殊的请求发现root目录。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

用户可参考如下厂商提供的安全补丁以修复该漏洞： https://nodesecurity.io/advisories/56

Reference

https://nodesecurity.io/advisories/56

Impacted products

Name
Joyent Node.js <0.11.1

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2015-8859"
    }
  },
  "description": "Joyent Node.js\u662f\u7f8e\u4e00\u5957\u5efa\u7acb\u5728Google V8 JavaScript\u5f15\u64ce\u4e4b\u4e0a\u7684\u7f51\u7edc\u5e94\u7528\u5e73\u53f0\u3002\r\n\r\nJoyent Node.js send\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u5141\u8bb8\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u63d0\u4ea4\u63d0\u4ea4\u7279\u6b8a\u7684\u8bf7\u6c42\u53d1\u73b0root\u76ee\u5f55\u3002",
  "discovererName": "Dinis Cruz",
  "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u5382\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u8865\u4e01\u4ee5\u4fee\u590d\u8be5\u6f0f\u6d1e\uff1a\r\nhttps://nodesecurity.io/advisories/56",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2016-02538",
  "openTime": "2016-04-26",
  "patchDescription": "Joyent Node.js\u662f\u7f8e\u4e00\u5957\u5efa\u7acb\u5728Google V8 JavaScript\u5f15\u64ce\u4e4b\u4e0a\u7684\u7f51\u7edc\u5e94\u7528\u5e73\u53f0\u3002\r\n\r\nJoyent Node.js send\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u5141\u8bb8\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u63d0\u4ea4\u63d0\u4ea4\u7279\u6b8a\u7684\u8bf7\u6c42\u53d1\u73b0root\u76ee\u5f55\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Joyent Node.js send ROOT\u76ee\u5f55\u53d1\u73b0\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Joyent Node.js \u003c0.11.1"
  },
  "referenceLink": "https://nodesecurity.io/advisories/56",
  "serverity": "\u4e2d",
  "submitTime": "2016-04-24",
  "title": "Joyent Node.js send ROOT\u76ee\u5f55\u53d1\u73b0\u6f0f\u6d1e"
}

FKIE_CVE-2015-8859

Vulnerability from fkie_nvd - Published: 2017-01-23 21:59 - Updated: 2026-06-17 00:35

Severity

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Summary

The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors.

References

URL	Tags
cve@mitre.org	http://www.openwall.com/lists/oss-security/2016/04/20/11	Mailing List, Third Party Advisory
cve@mitre.org	http://www.securityfocus.com/bid/96435	Broken Link, Third Party Advisory, VDB Entry
cve@mitre.org	https://nodesecurity.io/advisories/56	Broken Link, Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.openwall.com/lists/oss-security/2016/04/20/11	Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/96435	Broken Link, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	https://nodesecurity.io/advisories/56	Broken Link, Patch, Vendor Advisory

Impacted products

	Vendor	Product	Version
	send_project	send	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:send_project:send:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "E3AD6A79-80D5-4F94-9768-6914D8E9A13B",
              "versionEndExcluding": "0.11.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "El paquete send en versiones anteriores a 0.11.1 para Node.js permite a atacantes obter la ruta de root a trav\u00e9s de vectores no especificados."
    }
  ],
  "id": "CVE-2015-8859",
  "lastModified": "2026-06-17T00:35:22.947",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": true,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2017-01-23T21:59:00.657",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2016/04/20/11"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Broken Link",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/96435"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Broken Link",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://nodesecurity.io/advisories/56"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2016/04/20/11"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/96435"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://nodesecurity.io/advisories/56"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-JGQF-HWC5-HH37

Vulnerability from github – Published: 2017-10-24 18:33 – Updated: 2021-09-14 19:42

Summary

Root Path Disclosure in send

Details

Versions of send prior to 0.11.2 are affected by an information leakage vulnerability which may allow an attacker to enumerate paths on the server filesystem.

Recommendation

Update to version 0.11.1 or later.

Severity

5.3 (Medium)


                  
                    CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "send"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.11.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2015-8859"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:43:23Z",
    "nvd_published_at": "2017-01-23T21:59:00Z",
    "severity": "MODERATE"
  },
  "details": "Versions of `send` prior to 0.11.2 are affected by an information leakage vulnerability which may allow an attacker to enumerate paths on the server filesystem.\n\n\n\n## Recommendation\n\nUpdate to version 0.11.1 or later.",
  "id": "GHSA-jgqf-hwc5-hh37",
  "modified": "2021-09-14T19:42:25Z",
  "published": "2017-10-24T18:33:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8859"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pillarjs/send/pull/70"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pillarjs/send/commit/98a5b89982b38e79db684177cf94730ce7fc7aed"
    },
    {
      "type": "WEB",
      "url": "https://github.com/expressjs/serve-static/blob/master/HISTORY.md#181--2015-01-20"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pillarjs/send"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20200227192016/https://www.securityfocus.com/bid/96435"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2016/04/20/11"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Root Path Disclosure in send"
}

GSD-2015-8859

Vulnerability from gsd - Updated: 2023-12-13 01:20

Details

The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors.

Aliases

CVE-2015-8859

Aliases

CVE-2015-8859

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2015-8859",
    "description": "The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors.",
    "id": "GSD-2015-8859",
    "references": [
      "https://www.suse.com/security/cve/CVE-2015-8859.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2015-8859"
      ],
      "details": "The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors.",
      "id": "GSD-2015-8859",
      "modified": "2023-12-13T01:20:03.265701Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2015-8859",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "96435",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/96435"
          },
          {
            "name": "https://nodesecurity.io/advisories/56",
            "refsource": "CONFIRM",
            "url": "https://nodesecurity.io/advisories/56"
          },
          {
            "name": "[oss-security] 20160420 various vulnerabilities in Node.js packages",
            "refsource": "MLIST",
            "url": "http://www.openwall.com/lists/oss-security/2016/04/20/11"
          }
        ]
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003c0.11.1",
          "affected_versions": "All versions before 0.11.1",
          "credit": "Dinis Cruz",
          "cvss_v2": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "cvss_v3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-200",
            "CWE-937"
          ],
          "date": "2017-03-01",
          "description": "The send module discloses the root path.",
          "fixed_versions": [
            "0.11.1"
          ],
          "identifier": "CVE-2015-8859",
          "identifiers": [
            "CVE-2015-8859"
          ],
          "not_impacted": "All versions starting from 0.11.1",
          "package_slug": "npm/send",
          "pubdate": "2017-01-23",
          "solution": "Upgrade to version 0.11.1 or above.",
          "title": "Root Path Disclosure",
          "urls": [
            "https://github.com/expressjs/serve-static/blob/master/HISTORY.md#181--2015-01-20",
            "https://github.com/pillarjs/send/pull/70"
          ],
          "uuid": "e96f9803-f23d-4a41-9713-54a98f5bbfbb"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:send_project:send:*:*:*:*:*:node.js:*:*",
                "cpe_name": [],
                "versionEndExcluding": "0.11.1",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2015-8859"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-noinfo"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://nodesecurity.io/advisories/56",
              "refsource": "CONFIRM",
              "tags": [
                "Broken Link",
                "Patch",
                "Vendor Advisory"
              ],
              "url": "https://nodesecurity.io/advisories/56"
            },
            {
              "name": "[oss-security] 20160420 various vulnerabilities in Node.js packages",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "http://www.openwall.com/lists/oss-security/2016/04/20/11"
            },
            {
              "name": "96435",
              "refsource": "BID",
              "tags": [
                "Broken Link",
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://www.securityfocus.com/bid/96435"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": true,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 1.4
        }
      },
      "lastModifiedDate": "2023-09-12T19:42Z",
      "publishedDate": "2017-01-23T21:59Z"
    }
  }
}

UBUNTU-CVE-2015-8859 (CVE-2015-8859)

Vulnerability from osv_ubuntu – Published: 2017-01-23 21:59 – Updated: 2025-10-24 04:45 – Source website

Details

The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors.

Severity

5.3 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

N/A (UNKNOWN)

low

References

URL

Type

	https://ubuntu.com/security/CVE-2015-8859	REPORT
	http://www.openwall.com/lists/oss-security/2016/0…	REPORT
	https://nodesecurity.io/advisories/56	REPORT
	https://www.cve.org/CVERecord?id=CVE-2015-8859	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "node-send",
            "binary_version": "0.9.4-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "node-send",
        "purl": "pkg:deb/ubuntu/node-send@0.9.4-1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.9.4-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "node-send",
            "binary_version": "0.9.4-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "node-send",
        "purl": "pkg:deb/ubuntu/node-send@0.9.4-1?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.9.4-1"
      ]
    }
  ],
  "aliases": [],
  "details": "The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors.",
  "id": "UBUNTU-CVE-2015-8859",
  "modified": "2025-10-24T04:45:31Z",
  "published": "2017-01-23T21:59:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2015-8859"
    },
    {
      "type": "REPORT",
      "url": "http://www.openwall.com/lists/oss-security/2016/04/20/11"
    },
    {
      "type": "REPORT",
      "url": "https://nodesecurity.io/advisories/56"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-8859"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "low",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2015-8859"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2015-8859 (GCVE-0-2015-8859)

CNVD-2016-02538

FKIE_CVE-2015-8859

GHSA-JGQF-HWC5-HH37

Recommendation

GSD-2015-8859

UBUNTU-CVE-2015-8859 (CVE-2015-8859)

Tags

Sightings

Nomenclature

Related by attack behaviour