SB2018060117 - Multiple vulnerabilities in Zeit serve

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Information disclosure (CVE-ID: CVE-2019-5415)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

A bug in handling the ignore files and directories feature in serve 6.5.3 allows an attacker to read a file or list the directory that the victim has not allowed access to.

2) Information disclosure (CVE-ID: CVE-2018-3809)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

Information exposure through directory listings in serve 6.5.3 allows directory listing and file access even when they have been set to be ignored.

Remediation

Install update from vendor's website.

References

• https://hackerone.com/reports/330724
• https://hackerone.com/reports/330650