CVE-2022-25895

All versions of package lite-dev-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed to the req.url user input that is passed to the server code.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://gist.github.com/lirantal/0f8a48c3f5ac581ce73123abe9f7f120	Exploit Third Party Advisory
https://github.com/shadowwzw/lite-dev-server/blob/master/src/server.js%23L134	Broken Link
https://security.snyk.io/vuln/SNYK-JS-LITEDEVSERVER-3153718	Exploit Third Party Advisory
https://gist.github.com/lirantal/0f8a48c3f5ac581ce73123abe9f7f120	Exploit Third Party Advisory
https://github.com/shadowwzw/lite-dev-server/blob/master/src/server.js%23L134	Broken Link
https://security.snyk.io/vuln/SNYK-JS-LITEDEVSERVER-3153718	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:lite-dev-server_project:lite-dev-server:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-12-21 05:15

Updated : 2025-04-16 19:15

NVD link : CVE-2022-25895

Mitre link : CVE-2022-25895

CVE.ORG link : CVE-2022-25895

JSON object : View

Products Affected

lite-dev-server_project

lite-dev-server

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2022-25895", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "report@snyk.io", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2022-12-21T05:15:11.313", "references": [{"url": "https://gist.github.com/lirantal/0f8a48c3f5ac581ce73123abe9f7f120", "tags": ["Exploit", "Third Party Advisory"], "source": "report@snyk.io"}, {"url": "https://github.com/shadowwzw/lite-dev-server/blob/master/src/server.js%23L134", "tags": ["Broken Link"], "source": "report@snyk.io"}, {"url": "https://security.snyk.io/vuln/SNYK-JS-LITEDEVSERVER-3153718", "tags": ["Exploit", "Third Party Advisory"], "source": "report@snyk.io"}, {"url": "https://gist.github.com/lirantal/0f8a48c3f5ac581ce73123abe9f7f120", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/shadowwzw/lite-dev-server/blob/master/src/server.js%23L134", "tags": ["Broken Link"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.snyk.io/vuln/SNYK-JS-LITEDEVSERVER-3153718", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "All versions of package lite-dev-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed to the req.url user input that is passed to the server code."}, {"lang": "es", "value": "Todas las versiones del paquete lite-dev-server son vulnerables a Directory Traversal debido a la falta de sanitizaci\u00f3n de entrada y al uso de entornos sandbox para la entrada del usuario req.url que se pasa al c\u00f3digo del servidor."}], "lastModified": "2025-04-16T19:15:45.103", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lite-dev-server_project:lite-dev-server:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "68B7B5D5-58B7-416D-82FE-05A17FF24FE7"}], "operator": "OR"}]}], "sourceIdentifier": "report@snyk.io"}