Lucene search
GoogleOSV:CVE-2024-43800HistorySep 10, 2024 - 3:15 p.m.
CVE-2024-43800
2024-09-1015:15:17
Google
osv.dev
1
serve-static
untrusted user input
redirect()
code execution
patch
software
CVSS3
5
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
AI Score
6.7
Confidence
Low
serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.
Related
cvelist
cvelist
vulnrichment
vulnrichment
debiancve
debiancve
CVE-2024-43800
2024-09-10 15:15:17
nvd
nvd
CVE-2024-43800
2024-09-10 15:15:17
redhatcve
redhatcve
CVE-2024-43800
2024-09-10 17:43:42
cve
cve
CVE-2024-43800
2024-09-10 15:15:17
wolfi
wolfi
CVE-2024-43800 vulnerabilities
2024-09-20 03:31:48
github
github
serve-static vulnerable to template injection that can lead to XSS
2024-09-10 19:42:33
osv
osv
serve-static vulnerable to template injection that can lead to XSS
2024-09-10 19:42:33
CVSS3
5
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
AI Score
6.7
Confidence
Low
Related for OSV:CVE-2024-43800