{"id":"CVE-2024-31207","published":"2024-04-04T15:51:54Z","modified":"2024-08-02T01:46:04Z","title":"Vite's `server.fs.deny` did not deny requests for patterns with directories","vendor":"vitejs","product":"vite","tier":"tail","description":{"text":"Vite (French word for \"quick\", pronounced /vit/, like \"veet\") is a frontend build tooling to improve the frontend development experience.`server.fs.deny` does not deny requests for patterns with directories. This vulnerability has been patched in version(s) 5.2.6, 5.1.7, 5.0.13, 4.5.3, 3.2.10 and 2.9.18.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.9,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00711,"percentile":0.53592,"provenance":"source"},"cwes":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"},{"id":"CWE-284","name":"Improper Access Control"}],"references":[{"url":"https://github.com/vitejs/vite/security/advisories/GHSA-8jhw-289h-jh2g","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/vitejs/vite/commit/011bbca350e447d1b499d242804ce62738c12bc0","tags":["x_refsource_MISC"]},{"url":"https://github.com/vitejs/vite/commit/5a056dd2fc80dbafed033062fe6aaf4717309f48","tags":["x_refsource_MISC"]},{"url":"https://github.com/vitejs/vite/commit/89c7c645f09d16a38f146ef4a1528f218e844d67","tags":["x_refsource_MISC"]},{"url":"https://github.com/vitejs/vite/commit/96a7f3a41ef2f9351c46f3ab12489bb4efa03cc9","tags":["x_refsource_MISC"]},{"url":"https://github.com/vitejs/vite/commit/ba5269cca81de3f5fbb0f49d58a1c55688043258","tags":["x_refsource_MISC"]},{"url":"https://github.com/vitejs/vite/commit/d2db33f7d4b96750b35370c70dd2c35ec3b9b649","tags":["x_refsource_MISC"]}],"priority":{"score":14.8,"factors":[{"name":"EPSS percentile","points":10.72},{"name":"CVSS severity","points":4.13}]},"vendorSlug":"vitejs","affectedVersions":[{"vendor":"vitejs","product":"vite","versions":[">= 2.7.0, <= 2.9.17",">= 3.0.0, <= 3.2.8",">= 4.0.0, <= 4.5.2",">= 5.0.0, <= 5.0.12",">= 5.1.0, <= 5.1.6",">= 5.2.0, <= 5.2.5"]}],"affected":[{"ecosystem":"npm","package":"vite","vulnerableRanges":[">=2.7.0, <2.9.18",">=3.0.0, <3.2.10",">=4.0.0, <4.5.3",">=5.0.0, <5.0.13",">=5.1.0, <5.1.7",">=5.2.0, <5.2.6"],"patched":["2.9.18","3.2.10","4.5.3","5.0.13","5.1.7","5.2.6"],"from":["GHSA-8jhw-289h-jh2g"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-1159","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2023-34092","published":"2023-06-01","fixed":"4.3.9","kev":false},{"cve":"CVE-2023-49293","published":"2023-12-04","fixed":"5.0.5","kev":false},{"cve":"CVE-2024-23331","published":"2024-01-19","fixed":"5.0.12","kev":false,"link":{"from":"CVE-2024-23331","to":"CVE-2024-31207","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:vite","fromFixed":"2.9.17","toFixed":"2.9.18","daysApart":76},{"kind":"version-step","provenance":"source","package":"npm:vite","fromFixed":"3.2.8","toFixed":"3.2.10","daysApart":76}]}},{"cve":"CVE-2024-31207","published":"2024-04-04","fixed":"5.2.6","kev":false},{"cve":"CVE-2024-45811","published":"2024-09-17","fixed":"5.4.6","kev":false,"link":{"from":"CVE-2024-31207","to":"CVE-2024-45811","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:vite","fromFixed":"3.2.10","toFixed":"3.2.11","daysApart":166},{"kind":"version-step","provenance":"source","package":"npm:vite","fromFixed":"4.5.3","toFixed":"4.5.4","daysApart":166}]}},{"cve":"CVE-2024-45812","published":"2024-09-17","fixed":"5.4.6","kev":false,"link":{"from":"CVE-2024-31207","to":"CVE-2024-45812","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:vite","fromFixed":"3.2.10","toFixed":"3.2.11","daysApart":166},{"kind":"version-step","provenance":"source","package":"npm:vite","fromFixed":"4.5.3","toFixed":"4.5.4","daysApart":166}]}},{"cve":"CVE-2024-52011","published":"2026-06-01","fixed":"5.4.9","kev":false}],"package":"npm:vite"}}