Miggo Logo

CVE-2017-16159: Directory Traversal in caolilinode

7.5

CVSS Score
3.0

Basic Information

EPSS Score
0.67352%
Published
9/1/2020
Updated
9/13/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
caolilinodenpm>= 0.0.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The provided vulnerability information does not include concrete code snippets, commit diffs, or explicit references to specific functions in the caolilinode package. While the vulnerability is clearly described (directory traversal via improper path resolution), the lack of access to the actual implementation details (e.g., HTTP request handlers, file path resolution logic) makes it impossible to identify specific vulnerable functions with high confidence. The root cause likely resides in functions that process user-supplied URLs and resolve filesystem paths without proper sanitization, but no explicit function names or file paths are disclosed in the available data.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*****t** v*rsions o* `**olilino**` r*solv* r*l*tiv* *il* p*t*s, r*sultin* in * *ir**tory tr*v*rs*l vuln*r**ility. * m*li*ious **tor **n us* t*is vuln*r**ility to ****ss *il*s outsi** o* t** int*n*** *ir**tory root, w*i** m*y r*sult in t** *is*losur*

Reasoning

T** provi*** vuln*r**ility in*orm*tion *o*s not in*lu** *on*r*t* *o** snipp*ts, *ommit *i**s, or *xpli*it r***r*n**s to sp**i*i* *un*tions in t** `**olilino**` p**k***. W*il* t** vuln*r**ility is *l**rly **s*ri*** (*ir**tory tr*v*rs*l vi* improp*r p*