Untrusted User Input Vulnerability Patched in Express.js
CVE-2024-43796

4.7MEDIUM

Key Information:

Vendor

Expressjs

Status
Express
Vendor
CVE Published:
10 September 2024

What is CVE-2024-43796?

Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.

Affected Version(s)

express < 4.20.0 < 4.20.0

express >= 5.0.0-alpha.1, < 5.0.0 < 5.0.0-alpha.1, 5.0.0

References

https://github.com/expressjs/express/security/advisories/...
x_refsource_CONFIRM
https://github.com/expressjs/express/commit/54271f69b511f...
x_refsource_MISC

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2024-43796 : Untrusted User Input Vulnerability Patched in Express.js