{"id":"CVE-2024-31207","published":"2024-04-04T15:51:54Z","modified":"2024-08-02T01:46:04Z","title":"Vite's `server.fs.deny` did not deny requests for patterns with directories","vendor":"vitejs","product":"vite","tier":"tail","description":{"text":"Vite (French word for \"quick\", pronounced /vit/, like \"veet\") is a frontend build tooling to improve the frontend development experience.`server.fs.deny` does not deny requests for patterns with directories. This vulnerability has been patched in version(s) 5.2.6, 5.1.7, 5.0.13, 4.5.3, 3.2.10 and 2.9.18.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.9,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00711,"percentile":0.53549,"provenance":"source"},"cwes":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"},{"id":"CWE-284","name":"Improper Access Control"}],"references":[{"url":"https://github.com/vitejs/vite/security/advisories/GHSA-8jhw-289h-jh2g","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/vitejs/vite/commit/011bbca350e447d1b499d242804ce62738c12bc0","tags":["x_refsource_MISC"]},{"url":"https://github.com/vitejs/vite/commit/5a056dd2fc80dbafed033062fe6aaf4717309f48","tags":["x_refsource_MISC"]},{"url":"https://github.com/vitejs/vite/commit/89c7c645f09d16a38f146ef4a1528f218e844d67","tags":["x_refsource_MISC"]},{"url":"https://github.com/vitejs/vite/commit/96a7f3a41ef2f9351c46f3ab12489bb4efa03cc9","tags":["x_refsource_MISC"]},{"url":"https://github.com/vitejs/vite/commit/ba5269cca81de3f5fbb0f49d58a1c55688043258","tags":["x_refsource_MISC"]},{"url":"https://github.com/vitejs/vite/commit/d2db33f7d4b96750b35370c70dd2c35ec3b9b649","tags":["x_refsource_MISC"]}],"priority":{"score":14.8,"factors":[{"name":"EPSS percentile","points":10.71},{"name":"CVSS severity","points":4.13}]},"vendorSlug":"vitejs","affectedVersions":[{"vendor":"vitejs","product":"vite","versions":[">= 2.7.0, <= 2.9.17",">= 3.0.0, <= 3.2.8",">= 4.0.0, <= 4.5.2",">= 5.0.0, <= 5.0.12",">= 5.1.0, <= 5.1.6",">= 5.2.0, <= 5.2.5"]}],"affected":[{"ecosystem":"npm","package":"vite","vulnerableRanges":[">=2.7.0, <2.9.18",">=3.0.0, <3.2.10",">=4.0.0, <4.5.3",">=5.0.0, <5.0.13",">=5.1.0, <5.1.7",">=5.2.0, <5.2.6"],"patched":["2.9.18","3.2.10","4.5.3","5.0.13","5.1.7","5.2.6"],"from":["GHSA-8jhw-289h-jh2g"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-1159","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-vitejs-vite-cve-2022-35204","parents":[{"from":"CVE-2024-23331","to":"CVE-2024-31207","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"npm:vite","fromFixed":"2.9.17","toFixed":"2.9.18","daysApart":76},{"kind":"version-step","provenance":"source","package":"npm:vite","fromFixed":"3.2.8","toFixed":"3.2.10","daysApart":76},{"kind":"same-code","provenance":"machine","files":["packages/vite/src/node/server/index.ts"],"commits":["https://github.com/vitejs/vite/commit/91641c4da0a011d4c5352e88fc68389d4e1289a5","https://github.com/vitejs/vite/commit/0cd769c279724cf27934b1270fbdd45d68217691","https://github.com/vitejs/vite/commit/011bbca350e447d1b499d242804ce62738c12bc0","https://github.com/vitejs/vite/commit/5a056dd2fc80dbafed033062fe6aaf4717309f48"],"basis":"shared function","functions":["_createServer","serveRawFsMiddleware"]}]},{"from":"CVE-2022-35204","to":"CVE-2024-31207","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["packages/vite/src/node/server/middlewares/static.ts"],"commits":["https://github.com/vitejs/vite/commit/6851009e6725b17608113a5a63474280075cae1c","https://github.com/vitejs/vite/commit/e109d64331d9fa57753832762c3573c3532a6947","https://github.com/vitejs/vite/commit/011bbca350e447d1b499d242804ce62738c12bc0","https://github.com/vitejs/vite/commit/5a056dd2fc80dbafed033062fe6aaf4717309f48"],"basis":"shared function","functions":["serveRawFsMiddleware"]}]},{"from":"CVE-2023-34092","to":"CVE-2024-31207","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["packages/vite/src/node/server/middlewares/static.ts"],"commits":["https://github.com/vitejs/vite/commit/813ddd6155c3d54801e264ba832d8347f6f66b32","https://github.com/vitejs/vite/commit/011bbca350e447d1b499d242804ce62738c12bc0","https://github.com/vitejs/vite/commit/5a056dd2fc80dbafed033062fe6aaf4717309f48"],"basis":"shared function","functions":["serveRawFsMiddleware"]}]}],"children":[{"from":"CVE-2024-31207","to":"CVE-2024-45811","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"npm:vite","fromFixed":"3.2.10","toFixed":"3.2.11","daysApart":166},{"kind":"version-step","provenance":"source","package":"npm:vite","fromFixed":"4.5.3","toFixed":"4.5.4","daysApart":166},{"kind":"same-code","provenance":"machine","files":["packages/vite/src/node/server/middlewares/static.ts"],"commits":["https://github.com/vitejs/vite/commit/011bbca350e447d1b499d242804ce62738c12bc0","https://github.com/vitejs/vite/commit/5a056dd2fc80dbafed033062fe6aaf4717309f48","https://github.com/vitejs/vite/commit/6820bb3b9a54334f3268fc5ee1e967d2e1c0db34","https://github.com/vitejs/vite/commit/4573a6fd6f1b097fb7296a3e135e0646b996b249"],"basis":"shared function","functions":["isFileServingAllowed"]}]},{"from":"CVE-2024-31207","to":"CVE-2025-32395","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["packages/vite/src/node/server/index.ts"],"commits":["https://github.com/vitejs/vite/commit/011bbca350e447d1b499d242804ce62738c12bc0","https://github.com/vitejs/vite/commit/5a056dd2fc80dbafed033062fe6aaf4717309f48","https://github.com/vitejs/vite/commit/175a83909f02d3b554452a7bd02b9f340cdfef70"],"basis":"shared function","functions":["_createServer"]}]},{"from":"CVE-2024-31207","to":"CVE-2025-46565","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["packages/vite/src/node/server/middlewares/static.ts"],"commits":["https://github.com/vitejs/vite/commit/011bbca350e447d1b499d242804ce62738c12bc0","https://github.com/vitejs/vite/commit/5a056dd2fc80dbafed033062fe6aaf4717309f48","https://github.com/vitejs/vite/commit/c22c43de612eebb6c182dd67850c24e4fab8cacb"],"basis":"shared function","functions":["serveRawFsMiddleware"]}]},{"from":"CVE-2024-31207","to":"CVE-2025-58752","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["packages/vite/src/node/server/middlewares/static.ts"],"commits":["https://github.com/vitejs/vite/commit/011bbca350e447d1b499d242804ce62738c12bc0","https://github.com/vitejs/vite/commit/5a056dd2fc80dbafed033062fe6aaf4717309f48","https://github.com/vitejs/vite/commit/0ab19ea9fcb66f544328f442cf6e70f7c0528d5f","https://github.com/vitejs/vite/commit/14015d794f69accba68798bd0e15135bc51c9c1e"],"basis":"shared function","functions":["isFileServingAllowed"]}]}],"packageHistory":[{"cve":"CVE-2023-34092","published":"2023-06-01","fixed":"4.3.9","kev":false},{"cve":"CVE-2023-49293","published":"2023-12-04","fixed":"5.0.5","kev":false},{"cve":"CVE-2024-23331","published":"2024-01-19","fixed":"5.0.12","kev":false},{"cve":"CVE-2024-31207","published":"2024-04-04","fixed":"5.2.6","kev":false},{"cve":"CVE-2024-45811","published":"2024-09-17","fixed":"5.4.6","kev":false},{"cve":"CVE-2024-45812","published":"2024-09-17","fixed":"5.4.6","kev":false,"link":{"from":"CVE-2024-31207","to":"CVE-2024-45812","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:vite","fromFixed":"3.2.10","toFixed":"3.2.11","daysApart":166},{"kind":"version-step","provenance":"source","package":"npm:vite","fromFixed":"4.5.3","toFixed":"4.5.4","daysApart":166}]}},{"cve":"CVE-2024-52011","published":"2026-06-01","fixed":"5.4.9","kev":false}],"package":"npm:vite"}}