CVE-2024-31207
Vite's `server.fs.deny` did not deny requests for patterns with directories
Severity Score
5.9
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Track
*SSVC
Descriptions
Vite (French word for "quick", pronounced /vit/, like "veet") is a frontend build tooling to improve the frontend development experience.`server.fs.deny` does not deny requests for patterns with directories. This vulnerability has been patched in version(s) 5.2.6, 5.1.7, 5.0.13, 4.5.3, 3.2.10 and 2.9.18.
Vite (palabra francesa para "rápido", pronunciada /vit/, como "veet") es una herramienta de construcción de frontend para mejorar la experiencia de desarrollo de frontend. `server.fs.deny` no niega solicitudes de patrones con directorios. Esta vulnerabilidad ha sido parcheada en las versiones 5.2.6, 5.1.7, 5.0.13, 4.5.3, 3.2.10 y 2.9.18.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Track
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2024-03-29 CVE Reserved
- 2024-04-04 CVE Published
- 2024-04-05 EPSS Updated
- 2024-08-02 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- CWE-284: Improper Access Control
CAPEC
References (7)
| URL | Tag | Source |
|---|---|---|
| https://github.com/vitejs/vite/commit/011bbca350e447d1b499d242804ce62738c12bc0 | X_refsource_misc | |
| https://github.com/vitejs/vite/commit/5a056dd2fc80dbafed033062fe6aaf4717309f48 | X_refsource_misc | |
| https://github.com/vitejs/vite/commit/89c7c645f09d16a38f146ef4a1528f218e844d67 | X_refsource_misc | |
| https://github.com/vitejs/vite/commit/96a7f3a41ef2f9351c46f3ab12489bb4efa03cc9 | X_refsource_misc | |
| https://github.com/vitejs/vite/commit/ba5269cca81de3f5fbb0f49d58a1c55688043258 | X_refsource_misc | |
| https://github.com/vitejs/vite/commit/d2db33f7d4b96750b35370c70dd2c35ec3b9b649 | X_refsource_misc | |
| https://github.com/vitejs/vite/security/advisories/GHSA-8jhw-289h-jh2g | X_refsource_confirm |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Vitejs Search vendor "Vitejs" | Vite Search vendor "Vitejs" for product "Vite" | >= 2.7.0 <= 2.9.17 Search vendor "Vitejs" for product "Vite" and version " >= 2.7.0 <= 2.9.17" | en |
Affected
| ||||||
| Vitejs Search vendor "Vitejs" | Vite Search vendor "Vitejs" for product "Vite" | >= 3.0.0 <= 3.2.8 Search vendor "Vitejs" for product "Vite" and version " >= 3.0.0 <= 3.2.8" | en |
Affected
| ||||||
| Vitejs Search vendor "Vitejs" | Vite Search vendor "Vitejs" for product "Vite" | >= 4.0.0 <= 4.5.2 Search vendor "Vitejs" for product "Vite" and version " >= 4.0.0 <= 4.5.2" | en |
Affected
| ||||||
| Vitejs Search vendor "Vitejs" | Vite Search vendor "Vitejs" for product "Vite" | >= 5.0.0 <= 5.0.12 Search vendor "Vitejs" for product "Vite" and version " >= 5.0.0 <= 5.0.12" | en |
Affected
| ||||||
| Vitejs Search vendor "Vitejs" | Vite Search vendor "Vitejs" for product "Vite" | >= 5.1.0 <= 5.1.6 Search vendor "Vitejs" for product "Vite" and version " >= 5.1.0 <= 5.1.6" | en |
Affected
| ||||||
| Vitejs Search vendor "Vitejs" | Vite Search vendor "Vitejs" for product "Vite" | >= 5.2.0 <= 5.2.5 Search vendor "Vitejs" for product "Vite" and version " >= 5.2.0 <= 5.2.5" | en |
Affected
| ||||||