CVE-2024-29896 Astro-Shield's Content-Security-Policy header generation in middleware could be compromised by malicious injections

🗓️ 28 Mar 2024 12:48:53Reported by GitHub_MType

Astro-Shield's CSP header generation vulnerability fix available in version 1.3.

Reporter	Title	Published	Views	Family All 13
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities present in IBM Answer Retrieval for Watson Discovery versions 2.16 and earlier	29 May 202414:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Node.js	29 Jul 202421:55	–	ibm
CNNVD	Astro-Shield 安全漏洞	28 Mar 202400:00	–	cnnvd
CVE	CVE-2024-29896	28 Mar 202412:48	–	cve
EUVD	EUVD-2024-1019	3 Oct 202520:07	–	euvd
Github Security Blog	Content-Security-Policy header generation in middleware could be compromised by malicious injections	29 Mar 202419:03	–	github
NVD	CVE-2024-29896	28 Mar 202413:15	–	nvd
OSV	CVE-2024-29896 Astro-Shield's Content-Security-Policy header generation in middleware could be compromised by malicious injections	28 Mar 202412:48	–	osv
OSV	GHSA-W387-5QQW-7G8M Content-Security-Policy header generation in middleware could be compromised by malicious injections	29 Mar 202419:03	–	osv
Positive Technologies	PT-2024-23117 · Unknown · Astro-Shield	28 Mar 202400:00	–	ptsecurity

[
  {
    "vendor": "KindSpells",
    "product": "astro-shield",
    "versions": [
      {
        "version": "= 1.2.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/KindSpells/astro-shield/commit/41b84576d37fa486a57005ea297658d0bc38566d
github	www.github.com/KindSpells/astro-shield/security/advisories/GHSA-w387-5qqw-7g8m

28 Mar 2024 12:48Current

7.7High risk

Vulners AI Score7.7

CVSS 3.17.5

EPSS0.00591

CWE-74