CVE:CVE-2017-16125
CNNVD:CNNVD-201806-512
rtcmulticonnection-client是一个基于Node.js和Scoket.io的RTCMultiConnection.js的信令实现。
rtcmulticonnection-client中存在目录遍历漏洞。攻击者可通过在URL中放置‘../’序列利用该漏洞获取文件系统的访问权限。
solution:Upgrade rtcmulticonnection-client_project rtcmulticonnection-client to a higher version than 1.0.0,1.0.1,1.0.2,1.0.3,1.0.4,1.0.5,and avoid the version 1.0.0,1.0.1,1.0.2,1.0.3,1.0.4,1.0.5