CVE:CVE-2017-16184
CNNVD:CNNVD-201806-454
scott-blanch-weather-app是一款使用Express构建的Node.js天气预报应用程序。
scott-blanch-weather-app中存在目录遍历漏洞。攻击者可通过在URL中放置‘../’序列利用该漏洞获取文件系统的访问权限。
solution:Upgrade scott-blanch-weather-app_project scott-blanch-weather-app to a higher version than 1.0.0,and avoid the version 1.0.0