CVE-2014-6394

CVE Database · CVE-2014-6394

CVE-2014-6394

· N/AModified

CVSS v3.1

N/A

EPSS

4.26%

Published

Oct 8, 2014

Modified

May 6, 2026

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which allows remote attackers to access restricted directories, as demonstrated using "public-restricted" under a "public" directory.

Weaknesses (CWE)

CWE-22

Affected Products (8)

fedoraproject · fedoravulnerable

apple · xcodevulnerable

joyent · node.jsvulnerable

References (20)

http://lists.apple.com/archives/security-announce/2015/Sep/msg00002.html

http://lists.fedoraproject.org/pipermail/package-announce/2014-October/139938.html

http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140020.html

http://lists.fedoraproject.org/pipermail/package-announce/2014-September/139415.html

http://secunia.com/advisories/62170