Approved changes feed: RSS · Atom
cpe:2.3:a:nanohttpd:nanohttpd:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Nanohttpd (6bc243c8-05d8-5e3f-bf35-62284f08e270) |
|---|---|
| Product | Nanohttpd (268f3f85-3717-59e9-81ca-266cbde5515c) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/nanohttpd/nanohttpd |
purl2cpe | 2026-06-01 10:12:52.160268 |
pkg:maven/org.nanohttpd/nanohttpd |
purl2cpe | 2026-06-01 10:12:52.160271 |
pkg:sourceforge/nanohttpd.mirror |
purl2cpe | 2026-06-01 10:12:52.160274 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2022-21230 |
vulnerable | 2026-06-08 05:40:00.507542 |
Information Exposure
MEDIUM (5.5)
This affects all versions of package org.nanohttpd:nanohttpd. Whenever an HTTP Session is parsing the body of an HTTP request, the body of the request is written to a RandomAccessFile when the it is larger than 1024 bytes. This file is created with insecure permissions that allow its contents to be viewed by all users on the host machine. **Workaround:** Manually specifying the -Djava.io.tmpdir= argument when launching Java to set the temporary directory to a directory exclusively controlled by the current user can fix this issue.
Published: 2022-05-01T15:20:21.538Z
Updated: 2024-09-16T23:31:10.779Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-13697 |
vulnerable | 2026-06-08 05:18:01.023018 |
Details available
An issue was discovered in RouterNanoHTTPD.java in NanoHTTPD through 2.3.1. The GeneralHandler class implements a basic GET handler that prints debug information as an HTML page. Any web server that extends this class without implementing its own GET handler is vulnerable to reflected XSS, because the GeneralHandler GET handler prints user input passed through the query string without any sanitization.
Published: 2021-02-23T07:31:19.000Z
Updated: 2024-08-04T12:25:16.505Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.