CVE-2024-43800

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
GitHub_MCNA
5 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 8%
VendorProductVersion
openjsfserve-static
𝑥
< 1.16.0
openjsfserve-static
2.0.0 ≤
𝑥
< 2.1.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
node-serve-static
bullseye
postponed
bookworm
no-dsa
sid
2.1.0+~1.15.7-2
fixed
trixie
2.1.0+~1.15.7-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
node-serve-static
plucky
needs-triage
oracular
needs-triage
noble
needs-triage
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
Common Weakness Enumeration
References
https://github.com/expressjs/serve-static/commit/0c11fad159898cdc69fd9ab63269b72468ecaf6b
https://github.com/expressjs/serve-static/commit/ce730896fddce1588111d9ef6fdf20896de5c6fa
https://github.com/expressjs/serve-static/security/advisories/GHSA-cm22-4g7w-348p