CVE-2014-6393

Опубликовано: 09 авг. 2017

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400 level responses, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via characters in a non-standard encoding.

Ссылки

https://bugzilla.redhat.com/show_bug.cgi?id=1203190
Issue Tracking
Third Party Advisory
VDB Entry
https://nodesecurity.io/advisories/express-no-charset-in-content-type-header
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1203190
Issue Tracking
Third Party Advisory
VDB Entry
https://nodesecurity.io/advisories/express-no-charset-in-content-type-header
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:openjsf:express:*:*:*:*:*:*:*:*

Версия до 3.10.5 (включая)

cpe:2.3:a:openjsf:express:4.0.0:*:*:*:*:*:*:*

cpe:2.3:a:openjsf:express:4.1.0:*:*:*:*:*:*:*

cpe:2.3:a:openjsf:express:4.1.1:*:*:*:*:*:*:*

cpe:2.3:a:openjsf:express:4.1.2:*:*:*:*:*:*:*

cpe:2.3:a:openjsf:express:4.2.0:*:*:*:*:*:*:*

cpe:2.3:a:openjsf:express:4.3.0:*:*:*:*:*:*:*

cpe:2.3:a:openjsf:express:4.3.1:*:*:*:*:*:*:*

cpe:2.3:a:openjsf:express:4.3.2:*:*:*:*:*:*:*

cpe:2.3:a:openjsf:express:4.4.0:*:*:*:*:*:*:*

cpe:2.3:a:openjsf:express:4.4.1:*:*:*:*:*:*:*

cpe:2.3:a:openjsf:express:4.4.2:*:*:*:*:*:*:*

cpe:2.3:a:openjsf:express:4.4.3:*:*:*:*:*:*:*

cpe:2.3:a:openjsf:express:4.4.4:*:*:*:*:*:*:*

cpe:2.3:a:openjsf:express:4.4.5:*:*:*:*:*:*:*

EPSS

Процентиль: 52%

0.0029

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

CVE-2014-6393

CVSS3: 6.1

ubuntu

почти 8 лет назад

CVE-2014-6393

redhat

больше 10 лет назад

CVE-2014-6393

CVSS3: 6.1

debian

почти 8 лет назад

The Express web framework before 3.11 and 4.x before 4.5 for Node.js d ...

GHSA-gpvr-g6gh-9mc2

CVSS3: 6.1

github

больше 6 лет назад

No Charset in Content-Type Header in express

EPSS

Процентиль: 52%

0.0029

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79