Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-10491

A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used. The issue arises from improper sanitization in `Link` header values, which can allow a combination of characters like `,`, `;`, and `<>` to preload malicious resources. This vulnerability is especially relevant for dynamic parameters.

Published

2024-10-29T17:15:03.853

Last Modified

2024-11-06T23:08:49.780

Status

Analyzed

Source

36c7be3b-2937-45df-85ea-ca7133ea542c

Severity

CVSSv3.1: 4.0 (MEDIUM)

Weaknesses
  • Type: Secondary
    CWE-74
  • Type: Primary
    NVD-CWE-noinfo
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application openjsf express ≤ 3.21.4 Yes
References