Homepage
About Snyk

Access Control Bypass Affecting vite package, versions >=2.7.0 <2.9.17 >=3.0.0 <3.2.8 >=4.0.0 <4.5.2 >=5.0.0 <5.0.12

0.0
high
0
10

Snyk CVSS

    Attack Complexity Low
    Confidentiality High

    Threat Intelligence

    Exploit Maturity Proof of concept
    EPSS 0.07% (29th percentile)
Expand this section
NVD
7.5 high

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JS-VITE-6182924
  • published 21 Jan 2024
  • disclosed 19 Jan 2024
  • credit dariushoule
Report a new vulnerability Found a mistake?

Introduced: 19 Jan 2024

CVE-2024-23331 Open this link in a new tab
CWE-284 Open this link in a new tab

How to fix?

Upgrade vite to version 2.9.17, 3.2.8, 4.5.2, 5.0.12 or higher.

Overview

vite is a Native-ESM powered web dev build tool

Affected versions of this package are vulnerable to Access Control Bypass via the server.fs.deny option. An attacker can gain access to sensitive files by requesting raw filesystem paths using case-augmented versions of filenames. This is only exploitable if the server is hosted on a case-insensitive filesystem, including those used by Windows.