CVE-2014-10068

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The inert directory handler in inert node module before 1.1.1 always allows files in hidden directories to be served, even when `showHidden` is false.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
HackerOne	inert node module	<1.1.1

References

https://github.com/hapijs/inert/commit/e8f99f94da4cb08e8032eda984761c3f111e3e82Patch, Third Party Advisory
https://github.com/hapijs/inert/pull/15Issue Tracking, Patch, Third Party Advisory
https://nodesecurity.io/advisories/14Patch, Third Party Advisory
https://github.com/hapijs/inert/commit/e8f99f94da4cb08e8032eda984761c3f111e3e82Patch, Third Party Advisory
https://github.com/hapijs/inert/pull/15Issue Tracking, Patch, Third Party Advisory
https://nodesecurity.io/advisories/14Patch, Third Party Advisory

Timeline

Published: May 29, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-100697.5Hitron CVE-30360 devices use a 578A958E3DD933FC DES key that is shared across different customers' installations, which makes it easier for CVE-2014-100707.8zsh before 5.0.7 allows evaluation of the initial values of integer variables imported from the environment (instead of treating them as lit CVE-2014-100719.8In exec.c in zsh before 5.0.7, there is a buffer overflow for very long fds in the ">& fd" syntax.CVE-2014-100729.8In utils.c in zsh before 5.0.6, there is a buffer overflow when scanning very long directory paths for symbolic links.CVE-2014-100737.5The create_response function in server/server.c in Psensor before 1.1.4 allows Directory Traversal because it lacks a check for whether a fi CVE-2014-100749.8Umbraco before 7.2.0 has a remote PHP code execution vulnerability because Umbraco.Web.UI/config/umbracoSettings.Release.config does not blo CVE-2014-100759.8The karo gem 2.3.8 for Ruby allows Remote command injection via the host field.CVE-2014-100767.5The wp-db-backup plugin 2.2.4 for WordPress relies on a five-character string for access control, which makes it easier for remote attackers CVE-2014-100777.5Hash#slice in lib/i18n/core_ext/hash.rb in the i18n gem before 0.8.0 for Ruby allows remote attackers to cause a denial of service (applicat CVE-2014-100786.1Vembu StoreGrid 4.4.x has XSS in interface/registercustomer/onlineregsuccess.php, interface/registerreseller/onlineregfailure.php, interface CVE-2014-100795.3In Vembu StoreGrid 4.4.x, the front page of the server web interface leaks the private IP address in the "ipaddress" hidden form value of th CVE-2014-103746.5On Fitbit activity-tracker devices, certain addresses never change. According to the popets-2019-0036.pdf document, this leads to "permanent