CVE-2014-6393

Published: Aug 9, 2017Modified: May 13, 2026

6.1

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400 level responses, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via characters in a non-standard encoding.

Affected (15)

Products: Openjsf: Express

Openjsf

1 product

Express

Configuration A

15 vulnerable

Vulnerable Software	Affected Versions
Openjsf Express	Up to 3.10.5
Openjsf Express	Version 4.0.0
Openjsf Express	Version 4.1.0
Openjsf Express	Version 4.1.1
Openjsf Express	Version 4.1.2
Openjsf Express	Version 4.2.0
Openjsf Express	Version 4.3.0
Openjsf Express	Version 4.3.1
Openjsf Express	Version 4.3.2
Openjsf Express	Version 4.4.0
Openjsf Express	Version 4.4.1
Openjsf Express	Version 4.4.2
Openjsf Express	Version 4.4.3
Openjsf Express	Version 4.4.4
Openjsf Express	Version 4.4.5