CVE-2015-1164

Published: Jan 21, 2015Modified: May 6, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Open redirect vulnerability in the serve-static plugin before 1.7.2 for Node.js, when mounted at the root, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a // (slash slash) followed by a domain in the PATH_INFO to the default URI.

Affected (1)

Products: Serve Static Project: Serve Static

Serve Static Project

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Serve Static Project Serve Static	version ≤ 1.7.1

References (10)

http://nodesecurity.io/advisories/serve-static-open-redirect

Source: cve@mitre.org

http://www.securityfocus.com/bid/72064

Source: cve@mitre.org

https://bugzilla.redhat.com/show_bug.cgi?id=1181917

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/99936

Source: cve@mitre.org

https://github.com/expressjs/serve-static/issues/26

Source: cve@mitre.org

http://nodesecurity.io/advisories/serve-static-open-redirect

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/72064

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=1181917

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/99936

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/expressjs/serve-static/issues/26

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.