SB2018060117 - Multiple vulnerabilities in Zeit serve

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018060117

SB2018060117 - Multiple vulnerabilities in Zeit serve

Published: June 1, 2018 Updated: August 8, 2020

Security Bulletin ID SB2018060117
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 vulnerabilities.


1) Information disclosure (CVE-ID: CVE-2019-5415)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

A bug in handling the ignore files and directories feature in serve 6.5.3 allows an attacker to read a file or list the directory that the victim has not allowed access to.


2) Information disclosure (CVE-ID: CVE-2018-3809)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

Information exposure through directory listings in serve 6.5.3 allows directory listing and file access even when they have been set to be ignored.


Remediation

Install update from vendor's website.

References