« Volver al listado

CVE-2024-10491

Estado: AnalizadaMedia (5.3)—

A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used.

The issue arises from improper sanitization in `Link` header values, which can allow a combination of characters like `,`, `;`, and `<>` to preload malicious resources.

This vulnerability is especially relevant for dynamic parameters.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Openjsf — Express

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-10491",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-10491",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-29T19:42:55.922371Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "36c7be3b-2937-45df-85ea-ca7133ea542c",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "36c7be3b-2937-45df-85ea-ca7133ea542c",
      "affectedData": [
        {
          "repo": "https://github.com/expressjs/express",
          "vendor": "express",
          "product": "express",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.0-alpha1",
              "versionType": "semver",
              "lessThanOrEqual": "3.21.2"
            }
          ],
          "packageName": "express",
          "collectionURL": "https://www.npmjs.com/package/express",
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*"
          ],
          "vendor": "expressjs",
          "product": "express",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.0-alpha1",
              "versionType": "semver",
              "lessThanOrEqual": "3.21.2"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-10-29T17:15:03.853",
  "references": [
    {
      "url": "https://www.herodevs.com/vulnerability-directory/cve-2024-10491",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "36c7be3b-2937-45df-85ea-ca7133ea542c"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "36c7be3b-2937-45df-85ea-ca7133ea542c",
      "description": [
        {
          "lang": "en",
          "value": "CWE-74"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used.\n\nThe issue arises from improper sanitization in `Link` header values, which can allow a combination of characters like `,`, `;`, and `<>` to preload malicious resources.\n\nThis vulnerability is especially relevant for dynamic parameters."
    },
    {
      "lang": "es",
      "value": " Se ha identificado una vulnerabilidad en la función response.links de Express, que permite la inyección arbitraria de recursos en el encabezado Link cuando se utilizan datos no desinfectados. El problema surge de una desinfección incorrecta en los valores del encabezado `Link`, que puede permitir una combinación de caracteres como `,`, `;` y `&lt;&gt;` para precargar recursos maliciosos. Esta vulnerabilidad es especialmente relevante para los parámetros dinámicos."
    }
  ],
  "lastModified": "2026-06-17T06:55:47.223",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openjsf:express:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AE801416-30D2-4616-9933-65D020F892D8",
              "versionEndExcluding": "3.21.5",
              "versionStartIncluding": "3.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "36c7be3b-2937-45df-85ea-ca7133ea542c"
}