Information disclosure in Vitejs Vite
CVE-2024-45811
Vite a frontend build tooling framework for javascript. In affected versions the contents of arbitrary files can be returned to the browser. `@fs` denies access to files outside of Vite serving allow list. Adding `?import&raw` to the URL bypasses this limitation and returns the file content if it exists. This issue has been patched in versions 5.4.6, 5.3.6, 5.2.14, 4.5.5, and 3.2.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Vulnerability class: Information Disclosure
EPSS: 0.011 (62.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.8 (Medium). Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N.
Affected products
- Vitejs Vite — versions >= 5.4.0, < 5.4.6, >= 5.3.0, < 5.3.6, >= 5.0.0, < 5.2.14
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2024-45811?
- CVE-2024-45811 is a medium-severity vulnerability in Vitejs Vite, classified under Information Disclosure. CVSS score: 4.8/10. Published 2024-09-17.
- How severe is CVE-2024-45811?
- Medium severity. CVSS v3 base score is 4.8 out of 10.