CVE-2024-43799

2024-09-1015:15:17

CWE-79

GitHub_M

web.nvd.nist.gov

cve-2024-43799

send library

untrusted code

patched

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

AI Score

Confidence

High

EPSS

0.001

Percentile

17.7%

JSON

Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0.

Affected configurations

Nvd

Vulners

Node

send_projectsendRange<0.19.0node.js

VendorProductVersionCPE
send_projectsend*cpe:2.3:a:send_project:send:*:*:*:*:*:node.js:*:*

Vendor	Product	Version	CPE
send_project	send	*	cpe:2.3:a:send_project:send::::::node.js::*

CNA Affected

[
  {
    "vendor": "pillarjs",
    "product": "send",
    "versions": [
      {
        "version": "< 0.19.0",
        "status": "affected"
      }
    ]
  }
]