CVE:CVE-2017-16132
CNNVD:CNNVD-201806-505
simple-npm-registry是一个支持发布私有npm模块的软件包。
simple-npm-registry中存在目录遍历漏洞。攻击者可通过在URL中放置‘../’序列利用该漏洞获取文件系统的访问权限。
solution:Upgrade simple-npm-registry_project simple-npm-registry to a higher version than 0.0.4,and avoid the version (,0.0.4]