Path Traversal in Apple Xcode
CVE-2014-6394
visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which allows remote attackers to access restricted directories, as demonstrated using "public-restricted" under a "public" directory.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v2 metric
CVSS v2 base score 7.5 (High). Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.043 (90.9th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 91st percentile — 90.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.043 · newest: 0.043 · change: 0.000
Affected products
- Apple Xcode — versions 7.0
- Joyent Node.js — versions 0.8.0, 0.8.1, 0.8.2
- Fedoraproject Fedora — versions 19, 20, 21
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secunia.com/advisories/62170 (third-party-advisory)
- www.openwall.com/lists/oss-security/2014/09/30/10 (mailing-list)
- bugzilla.redhat.com/show_bug.cgi
- nodesecurity.io/advisories/send-directory-traversal
- github.com/visionmedia/send/pull/59
- support.apple.com/HT205217
- github.com/visionmedia/send/commit/9c6ca9b2c0b880afd3ff91ce0d211213c5fa5f9a (Exploit)
- lists.apple.com/archives/security-announce/2015/Sep/msg00002.html (vendor-advisory)
- lists.fedoraproject.org/pipermail/package-announce/2014-October/139938.html (vendor-advisory)
- lists.fedoraproject.org/pipermail/package-announce/2014-October/140020.html (vendor-advisory)
Frequently asked questions
- What is CVE-2014-6394?
- CVE-2014-6394 is a vulnerability in Apple Xcode, classified under Path Traversal. Published 2014-10-08.
- Is CVE-2014-6394 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.