CVE-2024-43799

2024-09-1015:15:17

CWE-79

GitHub_M

web.nvd.nist.gov

cve-2024-43799

send library

untrusted code

patched

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

AI Score

Confidence

High

EPSS

Percentile

9.6%

JSON

Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0.

Affected configurations

Vulners

Node

pillarjssendRange<0.19.0

VendorProductVersionCPE
pillarjssend*cpe:2.3:a:pillarjs:send:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
pillarjs	send	*	cpe:2.3:a:pillarjs:send::::::::

CNA Affected

[
  {
    "vendor": "pillarjs",
    "product": "send",
    "versions": [
      {
        "version": "< 0.19.0",
        "status": "affected"
      }
    ]
  }
]