CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 0CVE-2024-43800 – serve-static affected by template injection that can lead to XSS
https://notcve.org/view.php?id=CVE-2024-43800
serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0. serve-static sirve archivos estáticos. serve-static pasa información de usuario no confiable (incluso después de sanearla) a redirect() y puede ejecutar código no confiable. Este problema se solucionó en serve-static 1.16.0. A flaw was found in serve-static. This issue may allow the execution of untrusted code via passing sanitized yet untrusted user input to redirect(). • https://github.com/expressjs/serve-static/commit/0c11fad159898cdc69fd9ab63269b72468ecaf6b https://github.com/expressjs/serve-static/commit/ce730896fddce1588111d9ef6fdf20896de5c6fa https://github.com/expressjs/serve-static/security/advisories/GHSA-cm22-4g7w-348p https://access.redhat.com/security/cve/CVE-2024-43800 https://bugzilla.redhat.com/show_bug.cgi?id=2311154 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2015-1164
https://notcve.org/view.php?id=CVE-2015-1164
Open redirect vulnerability in the serve-static plugin before 1.7.2 for Node.js, when mounted at the root, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a // (slash slash) followed by a domain in the PATH_INFO to the default URI. Vulnerabilidad de la re-dirección abierta en el plugin serve-static anterior a 1.7.2 para Node.js, cuando se monta en root, permite a atacantes redirigir usuarios a un sitio web arbitrario y conllevar ataques de suplantación a través de // (barra barra) seguido del dominio en el PATH_INFO en la URI por defecto. • http://nodesecurity.io/advisories/serve-static-open-redirect http://www.securityfocus.com/bid/72064 https://bugzilla.redhat.com/show_bug.cgi?id=1181917 https://exchange.xforce.ibmcloud.com/vulnerabilities/99936 https://github.com/expressjs/serve-static/issues/26 •