CVE-2017-16198

ritp is a static web server. ritp is vulnerable to a directory traversal issue whereby an attacker can gain access to the file system by placing ../ in the URL. Access is restricted to files with a file extension, so files such as /etc/passwd are not accessible.

CVSS v3.0

7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v3.0

7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

2.00% chance of exploitation in the next 30 days, 79th percentile

Published

2018-06-07

Updated

2024-08-05

Proof-of-concept exploits (1)

• JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/ritp

References

• CVE Record
• NVD entry

Related

• CVE-2017-16197
• CVE-2017-16199
• CVE-2017-16196
• CVE-2017-16200
• CVE-2017-16195
• CVE-2017-16201