Main Vulnerability Database Vulnerabilities #VU37087

Information disclosure in serve - CVE-2018-3809

Published: June 1, 2018 / Updated: August 8, 2020

Vulnerability identifier: #VU37087

CSH Severity: Medium

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2018-3809

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vendor: Zeit

Affected software:
serve

Detailed vulnerability description

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

Information exposure through directory listings in serve 6.5.3 allows directory listing and file access even when they have been set to be ignored.

Install update from vendor's website.