You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode using encodeurl on the contents before passing it to the location header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is res.location() but this is also called from within res.redirect(). The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3.
✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
mend-for-github-combot
changed the title
CVE-2024-29041 (Medium) detected in express-4.18.3.tgz
CVE-2024-29041 (Medium) detected in express-4.18.3.tgz - autoclosed
May 4, 2024
mend-for-github-combot
changed the title
CVE-2024-29041 (Medium) detected in express-4.18.3.tgz - autoclosed
CVE-2024-29041 (Medium) detected in express-4.18.3.tgz
May 4, 2024
ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.
mend-for-github-combot
changed the title
CVE-2024-29041 (Medium) detected in express-4.18.3.tgz
CVE-2024-29041 (Medium) detected in express-4.18.3.tgz - autoclosed
May 19, 2024
CVE-2024-29041 - Medium Severity Vulnerability
Vulnerable Library - express-4.18.3.tgz
Library home page: https://registry.npmjs.org/express/-/express-4.18.3.tgz
Path to dependency file: /templates/react-website-template/app/package.json
Path to vulnerable library: /templates/react-website-template/app/node_modules/express/package.json
Dependency Hierarchy:
Found in HEAD commit: 712665b267203375ee4b15e1f8d1ebe08abc1547
Found in base branch: develop
Vulnerability Details
Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode using
encodeurl
on the contents before passing it to thelocation
header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted isres.location()
but this is also called from withinres.redirect()
. The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3.Publish Date: 2024-03-25
URL: CVE-2024-29041
CVSS 3 Score Details (6.1)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-rv95-896h-c2vc
Release Date: 2024-03-25
Fix Resolution: express - 4.19.0
The text was updated successfully, but these errors were encountered: