CVE-2019-8903

• GHSA-3q32-j57w-q4w7

• 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

{
    "unresolved_ranges": [
        {
            "source": "CPE_RANGE",
            "cpes": [
                "cpe:2.3:a:totaljs:total.js:*:*:*:*:*:node.js:*:*"
            ],
            "extracted_events": [
                {
                    "fixed": "3.2.3"
                },
                {
                    "fixed": "3.2.3"
                },
                {
                    "fixed": "3.2.3"
                }
            ],
            "vendor_product": "totaljs:total.js"
        },
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "fixed": "3.2.3"
                }
            ]
        }
    ]
}

• https://github.com/totaljs/framework/commit/c37cafbf3e379a98db71c1125533d1e8d5b5aef7
• https://github.com/totaljs/framework/commit/de16238d13848149f5d1dae51f54e397a525932b
• https://blog.certimetergroup.com/it/articolo/security/total.js-directory-traversal-cve-2019-8903