Log in Start free

Vulnerability · Published Apr 4, 2024 · Assigned by GitHub_M

CVE-2024-31207Vite's `server.fs.deny` did not deny requests for patterns with directories

Medium 5.9

In plain English

A medium-severity information exposure in vite from vitejs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.7%top 46.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Vite (French word for "quick", pronounced /vit/, like "veet") is a frontend build tooling to improve the frontend development experience.`server.fs.deny` does not deny requests for patterns with directories. This vulnerability has been patched in version(s) 5.2.6, 5.1.7, 5.0.13, 4.5.3, 3.2.10 and 2.9.18.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npmvite2.9.18GHSA-8jhw-289h-jh2g
npmvite3.2.10GHSA-8jhw-289h-jh2g
npmvite4.5.3GHSA-8jhw-289h-jh2g
npmvite5.0.13GHSA-8jhw-289h-jh2g
npmvite5.1.7GHSA-8jhw-289h-jh2g
npmvite5.2.6GHSA-8jhw-289h-jh2g

Affected products (as reported)

VendorProductVersions
vitejs vite >= 2.7.0, <= 2.9.17>= 3.0.0, <= 3.2.8>= 4.0.0, <= 4.5.2>= 5.0.0, <= 5.0.12>= 5.1.0, <= 5.1.6>= 5.2.0, <= 5.2.5

Weakness: CWE-200, CWE-284 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References