5.4

CVE-2018-3717: hackerone connect node module Cross-site Scripting

CVSS: 5.4v3.1MediumModified
AliasesUBUNTU-CVE-2018-3717DEBIAN-CVE-2018-3717GHSA-rch9-xh7r-mqgw
Published 07-06-2018Last modified 16-09-2024
Open JSON

Vulnerability summary

CVE-2018-3717 is a medium (CVSS 5.4) Cross-site Scripting vulnerability in hackerone connect node module. EPSS estimates a 1.31% chance of exploitation in the next 30 days, higher than 70.1% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk
32/100
0100
Medium · default modelHow is this calculated?
CVSS score
5.4/10
010
Medium · v3.1 (NVD)
EPSS score
1.31%
0%100%
Low · -0.02 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits2reference

Timeline

  1. 07-06-2018
    PublishedVulnerability first disclosed.
  2. 16-09-2024
    Last modifiedVulnerability information updated.

Description

connect node module before 2.14.0 suffers from a Cross-Site Scripting (XSS) vulnerability due to a lack of validation of file in directory.js middleware.

CVSS metrics

6 scores · 4 sources · 3 versions

EPSS trend

Probability

1.31%

Chance of exploitation in the next 30 days

Percentile

70%

Versus all other CVEs

30-day change

-0.02 pp

From 1.33% on 19-09-2026

19-09-202619-10-2026
EPSS score
1.31%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found
  • referenceUnverified

    Exploit Reference (hackerone.com)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (hackerone.com)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Debian1 product
  • node-connect< 3.0.0-1
Hackerone1 product
Npm1 product
  • connect< 2.14.0
Sencha1 product
Ubuntu1 product
  • node-connect< 3.4.1-1

5 vendors · 5 products

References

11 links
Show all 11 references