Aller au contenu
en Se connecter
6.1 Moyenne

CVE-2024-29041 Express.js minimalist web framework for node

Description

Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode [using `encodeurl`](https://github.com/pillarjs/encodeurl) on the contents before passing it to the `location` header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is `res.location()` but this is also called from within `res.redirect()`. The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3.

Produits et versions touchés

Produit Versions touchées Corrigé en
express 5.0 5.0.0-alpha.1 → < 5.0.0-beta.3 5.0.0-beta.3
express 4.14 4.14.0 → < 4.19.0 4.19.0

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de express

Les 4 CVE de express →
CVE-2024-10491 A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in… 4.0 Moyenne CVE-2024-9266 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Express 4.7 Moyenne CVE-2024-43796 Express.js minimalist web framework for node 5.0 Moyenne
Suivre cette CVE