CVE-2020-7684

EUVD-2021-0942
This affects all versions of package rollup-plugin-serve. There is no path sanitization in readFile operation.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
snykCNA
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 68%
Affected Products (NVD)
VendorProductVersion
rollup-plugin-serve_projectrollup-plugin-serve
*
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://snyk.io/vuln/SNYK-JS-FASTHTTP-572886
https://vuldb.com/?id.158745
https://snyk.io/vuln/SNYK-JS-FASTHTTP-572886