// For flags

CVE-2023-50710

Hono's named path parameters can be overridden in TrieRouter

Severity Score

4.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Hono is a web framework written in TypeScript. Prior to version 3.11.7, clients may override named path parameter values from previous requests if the application is using TrieRouter. So, there is a risk that a privileged user may use unintended parameters when deleting REST API resources. TrieRouter is used either explicitly or when the application matches a pattern that is not supported by the default RegExpRouter. Version 3.11.7 includes the change to fix this issue. As a workaround, avoid using TrieRouter directly.

Hono es un framework web escrito en TypeScript. Antes de la versión 3.11.7, los clientes pueden anular los valores de los parámetros de ruta con nombre de solicitudes anteriores si la aplicación utiliza TrieRouter. Por lo tanto, existe el riesgo de que un usuario privilegiado utilice parámetros no deseados al eliminar recursos de la API REST. TrieRouter se usa explícitamente o cuando la aplicación coincide con un patrón que no es compatible con el RegExpRouter predeterminado. La versión 3.11.7 incluye el cambio para solucionar este problema. Como workaround, evite utilizar TrieRouter directamente.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2023-12-11 CVE Reserved
  • 2023-12-14 CVE Published
  • 2023-12-20 EPSS Updated
  • 2024-08-02 CVE Updated
  • 2024-08-02 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-94: Improper Control of Generation of Code ('Code Injection')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Hono
Search vendor "Hono"
Hono
Search vendor "Hono" for product "Hono"
< 3.11.7
Search vendor "Hono" for product "Hono" and version " < 3.11.7"
node.js
Affected