{"id":"CVE-2022-35204","published":"2022-08-18T18:15:21Z","modified":"2024-08-03T09:29:17Z","title":"Vitejs Vite before v2.9.13 was discovered to allow attackers to perform a directory traversal via a crafted URL to the…","vendor":null,"product":null,"tier":"tail","description":{"text":"Vitejs Vite before v2.9.13 was discovered to allow attackers to perform a directory traversal via a crafted URL to the victim's service.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01294,"percentile":0.70284,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/vitejs/vite/issues/8498","tags":["x_refsource_MISC"]},{"url":"https://github.com/vitejs/vite/releases/tag/v2.9.13","tags":["x_refsource_MISC"]},{"url":"https://github.com/vitejs/vite/releases/tag/v3.0.0-beta.4","tags":["x_refsource_MISC"]}],"priority":{"score":14.1,"factors":[{"name":"EPSS percentile","points":14.06}]},"affected":[{"ecosystem":"npm","package":"vite","vulnerableRanges":["<2.9.13",">=3.0.0-alpha.0, <3.0.0-beta.4"],"patched":["2.9.13","3.0.0-beta.4"],"from":["GHSA-mv48-hcvh-8jj8"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-6589","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-vitejs-vite-cve-2022-35204","children":[{"from":"CVE-2022-35204","to":"CVE-2023-34092","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"npm:vite","fromFixed":"2.9.13","toFixed":"2.9.16","daysApart":287},{"kind":"same-code","provenance":"machine","files":["packages/vite/src/node/server/middlewares/static.ts"],"commits":["https://github.com/vitejs/vite/commit/6851009e6725b17608113a5a63474280075cae1c","https://github.com/vitejs/vite/commit/e109d64331d9fa57753832762c3573c3532a6947","https://github.com/vitejs/vite/commit/813ddd6155c3d54801e264ba832d8347f6f66b32"],"basis":"shared function","functions":["serveRawFsMiddleware","serveStaticMiddleware"]}]},{"from":"CVE-2022-35204","to":"CVE-2024-23331","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["packages/playground/fs-serve/root/src/index.html"],"commits":["https://github.com/vitejs/vite/commit/6851009e6725b17608113a5a63474280075cae1c","https://github.com/vitejs/vite/commit/e109d64331d9fa57753832762c3573c3532a6947","https://github.com/vitejs/vite/commit/91641c4da0a011d4c5352e88fc68389d4e1289a5","https://github.com/vitejs/vite/commit/0cd769c279724cf27934b1270fbdd45d68217691"],"basis":"shared function","functions":["serveRawFsMiddleware"]}]},{"from":"CVE-2022-35204","to":"CVE-2024-31207","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["packages/vite/src/node/server/middlewares/static.ts"],"commits":["https://github.com/vitejs/vite/commit/6851009e6725b17608113a5a63474280075cae1c","https://github.com/vitejs/vite/commit/e109d64331d9fa57753832762c3573c3532a6947","https://github.com/vitejs/vite/commit/011bbca350e447d1b499d242804ce62738c12bc0","https://github.com/vitejs/vite/commit/5a056dd2fc80dbafed033062fe6aaf4717309f48"],"basis":"shared function","functions":["serveRawFsMiddleware"]}]},{"from":"CVE-2022-35204","to":"CVE-2025-46565","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["packages/vite/src/node/server/middlewares/static.ts"],"commits":["https://github.com/vitejs/vite/commit/6851009e6725b17608113a5a63474280075cae1c","https://github.com/vitejs/vite/commit/e109d64331d9fa57753832762c3573c3532a6947","https://github.com/vitejs/vite/commit/c22c43de612eebb6c182dd67850c24e4fab8cacb"],"basis":"shared function","functions":["serveRawFsMiddleware","serveStaticMiddleware"]}]}],"packageHistory":[{"cve":"CVE-2022-35204","published":"2022-08-18","fixed":"3.0.0-beta.4","kev":false},{"cve":"CVE-2023-34092","published":"2023-06-01","fixed":"4.3.9","kev":false},{"cve":"CVE-2023-49293","published":"2023-12-04","fixed":"5.0.5","kev":false},{"cve":"CVE-2024-23331","published":"2024-01-19","fixed":"5.0.12","kev":false}],"package":"npm:vite"}}