The vulnerability of the Express.js template for Node.js web application development, related to the redirection of URL addresses to unreliable websites used by the incoming component, allows attackers to redirect users to arbitrary URL addresses.

🗓️ 29 Jul 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 8 Views

Express.js template vulnerability allows open redirection to arbitrary URLs via malformed addresses.

Reporter	Title	Published	Views	Family All 95
IBM Security Bulletins	Security Bulletin: security vulnerabilities are addressed with IBM Business Automation Insights iFix for April 2024.	27 Apr 202413:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security QRadar EDR Software contains multiple vulnerabilities	8 Jul 202409:49	–	ibm
IBM Security Bulletins	Security Bulletin: PVR0501342 [Express - CVE-2024-29041 (Publicly disclosed vulnerability) ]	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in express-4.17.3.tgz	7 Jul 202517:57	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ Appliance vulnerable to open redirect (CVE-2024-29041)	26 Jun 202422:29	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Verify Governance has multiple vulnerabilities	10 Jul 202416:31	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities fixed in IBM Security Verify Information Queue	5 Aug 202409:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses express-4.18.2.tgz which is vulnerable to CVE-2024-29041.	6 Jun 202406:30	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Advisor With Watson for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	17 Mar 202513:46	–	ibm
IBM Security Bulletins	Security Bulletin: There are multiple vulnerabilities that can affect IBM Fusion HCI and IBM Fusion HCI for watsonx	31 May 202514:07	–	ibm

Source	Link
github	www.github.com/expressjs/express/commit/0867302ddbde0e9463d0564fea5861feb708c2dd
github	www.github.com/expressjs/express/commit/0b746953c4bd8e377123527db11f9cd866e39f94
github	www.github.com/expressjs/express/pull/5539
github	www.github.com/expressjs/express/security/advisories/GHSA-rv95-896h-c2vc
redos	www.redos.red-soft.ru/support/secure/
web	www.web.nvd.nist.gov/view/vuln/detail

29 Jul 2024 00:00Current

6.7Medium risk

Vulners AI Score6.7

CVSS 36.1

CVSS 26.4

EPSS0.00786

open redirection express javascript template malformed addresses arbitrary addresses web application