CVE-2024-43800: expressjs serve-static Cross-site Scripting
CVSS: 5.0v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2024-43800DEBIAN-CVE-2024-43800CGA-28fh-gm5v-wfw3CGA-4hvr-xv2x-6jxwCGA-53c8-hmxx-3c8mCGA-5437-x4wr-g3hwCGA-5fx8-cw2p-rf7wCGA-6m64-8gc4-9q8mCGA-727v-7m4r-xw4jCGA-782j-4mcq-85q5CGA-87vg-prr3-3v59CGA-89wh-h2cf-v273CGA-8j7x-gr3m-6hx5CGA-8r6q-mrm4-54x8CGA-9ppv-phf7-5f8cCGA-9qgr-cjc3-826hCGA-c2h6-946p-4qxrCGA-c98p-5qc8-92r5CGA-chqm-c2wm-7jjxCGA-cwmj-83w2-f92hCGA-f9hh-25pq-xj4jCGA-hpjx-p8gx-gm89CGA-jw37-5qxx-g8p2CGA-m3q9-33wr-h63fCGA-qjm7-r3m7-6whhCGA-rhfr-h8p5-56f3CGA-rx2f-4x3v-7wq7CGA-v28c-vqp7-r5jpCGA-v6j9-vqv4-rmqmCGA-v929-6hpw-q7v5CGA-wgfc-4wpc-84m8CGA-wr56-fm55-wxmqCGA-wv9w-3rjh-j2hcCGA-wxm3-jgcr-jp5hGHSA-cm22-4g7w-348pCGA-9fxm-65jq-wwqhCGA-xghw-c6rf-9w6c
Published 10-09-2024Last modified 10-09-2024
Vulnerability summary
CVE-2024-43800 is a medium (CVSS 5.0) Cross-site Scripting vulnerability in expressjs serve-static. EPSS estimates a 0.63% chance of exploitation in the next 30 days, higher than 49.2% of scored vulnerabilities.
CVSS score
5.0/10
010
Medium · v3.1 (CVE.org)EPSS score
0.63%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 4Timeline
- 10-09-2024PublishedVulnerability first disclosed.
- 10-09-2024Last modifiedVulnerability information updated.
Description
serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.
CVSS metrics
8 scores · 7 sources · 2 versionsLow 2.3Preferred score · OSV · Npm (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:LSourcesSingle source
Medium 5.0Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:LSources7 sources · 4.7–5.0
- OSV · UbuntuEcosystem advisory · calculated4.7MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:NDiffers
- OSV · DebianEcosystem advisory · calculated4.7MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:NDiffers
- OSV · WolfiEcosystem advisory · calculated5.0MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
- OSV · NpmEcosystem advisory · calculated5.0MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
- OSV · ChainguardEcosystem advisory · calculated5.0MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
- NVDNIST4.7MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:NDiffers
EPSS trend
Probability
0.63%
Chance of exploitation in the next 30 days
Percentile
49%
Versus all other CVEs
30-day change
0.00 pp
From 0.63% on 19-09-2026
19-09-202619-10-2026
EPSS score0.63%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard17 products
- arangodb-3.11< 3.11.14.5-r25
- argo-workflows< 3.6.5-r2
- kubeflow-centraldashboard< 1.9.0-r4
- kubeflow-pipelines< 2.2.0-r12
- kubeflow-pipelines-apiserver< 2.2.0-r12
Wolfi16 products
- argo-workflows< 3.6.5-r2
- kubeflow-centraldashboard< 1.9.0-r4
- kubeflow-pipelines< 2.2.0-r12
- kubeflow-pipelines-apiserver< 2.2.0-r12
- kubeflow-pipelines-cache_server< 2.2.0-r12
Debian1 product
- node-serve-staticAll versions (No fix recorded) | < 2.1.0+~1.15.7-1
Expressjs1 product
- serve-static< 1.16.0 | ≥ 2.0.0, < 2.1.0
Npm1 product
- serve-static< 1.16.0 | ≥ 2.0.0, < 2.1.0
Openjsf1 product
- serve-static< 1.16.0 | ≥ 2.0.0, < 2.1.0
Ubuntu1 product
- node-serve-staticAll versions (No fix recorded)
7 vendors · 38 products
References
9 links- github.com/expressjs/serve-static/security/advisories/GHSA-cm22-4g7w-348pX Refsource CONFIRMREPORTAdvisoryWEBVendor Advisory
- github.com/expressjs/serve-static/commit/0c11fad159898cdc69fd9ab63269b72468ecaf6bX Refsource MISCFIXWEBPatch
- github.com/expressjs/serve-static/commit/ce730896fddce1588111d9ef6fdf20896de5c6faX Refsource MISCFIXWEBPatch
