UBUNTU-CVE-2024-10491: node-express Ubuntu
CVSS: 5.3v3.1MediumPublished
Published 29-10-2024Last modified 04-02-2026
Vulnerability summary
UBUNTU-CVE-2024-10491 is a medium (CVSS 5.3) vulnerability in node-express Ubuntu.
CVSS score
5.3/10
010
Medium · v3.1 (OSV · Ubuntu), selected by version preferenceEPSS score
Not scored
0%100%
No EPSS score yetKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 29-10-2024PublishedVulnerability first disclosed.
- 04-02-2026Last modifiedVulnerability information updated.
Description
A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used. The issue arises from improper sanitization in `Link` header values, which can allow a combination of characters like `,`, `;`, and `<>` to preload malicious resources. This vulnerability is especially relevant for dynamic parameters.
CVSS metrics
1 score · 1 source · 1 versionMedium 5.3Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NSourcesSingle source
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Ubuntu1 product
- node-expressAll versions (No fix recorded)
1 vendor · 1 product