Nanohttpd : Security Vulnerabilities CVSS score >= 3

This affects all versions of package org.nanohttpd:nanohttpd. Whenever an HTTP Session is parsing the body of an HTTP request, the body of the request is written to a RandomAccessFile when the it is larger than 1024 bytes. This file is created with insecure permissions that allow its contents to be viewed by all users on the host machine. **Workaround:** Manually specifying the argument when launching Java to set the temporary directory to a directory exclusively controlled by the current user can fix this issue.
Max Base Score
Published 2022-05-01
Updated 2022-05-11
EPSS 0.05%
An issue was discovered in in NanoHTTPD through 2.3.1. The GeneralHandler class implements a basic GET handler that prints debug information as an HTML page. Any web server that extends this class without implementing its own GET handler is vulnerable to reflected XSS, because the GeneralHandler GET handler prints user input passed through the query string without any sanitization.
Max Base Score
Published 2021-02-23
Updated 2021-02-26
EPSS 0.06%
2 vulnerabilities found
This web site uses cookies for managing your session and website analytics (Google analytics) purposes as described in our privacy policy.
By using this web site you are agreeing to terms of use!