{"id":"CVE-2022-35204","published":"2022-08-18T18:15:21Z","modified":"2024-08-03T09:29:17Z","title":"Vitejs Vite before v2.9.13 was discovered to allow attackers to perform a directory traversal via a crafted URL to the…","vendor":null,"product":null,"tier":"tail","description":{"text":"Vitejs Vite before v2.9.13 was discovered to allow attackers to perform a directory traversal via a crafted URL to the victim's service.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01294,"percentile":0.7032,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/vitejs/vite/issues/8498","tags":["x_refsource_MISC"]},{"url":"https://github.com/vitejs/vite/releases/tag/v2.9.13","tags":["x_refsource_MISC"]},{"url":"https://github.com/vitejs/vite/releases/tag/v3.0.0-beta.4","tags":["x_refsource_MISC"]}],"priority":{"score":14.1,"factors":[{"name":"EPSS percentile","points":14.06}]},"affected":[{"ecosystem":"npm","package":"vite","vulnerableRanges":["<2.9.13",">=3.0.0-alpha.0, <3.0.0-beta.4"],"patched":["2.9.13","3.0.0-beta.4"],"from":["GHSA-mv48-hcvh-8jj8"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-6589","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2022-35204","published":"2022-08-18","fixed":"3.0.0-beta.4","kev":false},{"cve":"CVE-2023-34092","published":"2023-06-01","fixed":"4.3.9","kev":false,"link":{"from":"CVE-2022-35204","to":"CVE-2023-34092","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:vite","fromFixed":"2.9.13","toFixed":"2.9.16","daysApart":287}]}},{"cve":"CVE-2023-49293","published":"2023-12-04","fixed":"5.0.5","kev":false},{"cve":"CVE-2024-23331","published":"2024-01-19","fixed":"5.0.12","kev":false}],"package":"npm:vite"}}