CVE-2024-10491

Published: Oct 29, 2024Modified: Jan 8, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used. The issue arises from improper sanitization in `Link` header values, which can allow a combination of characters like `,`, `;`, and `<>` to preload malicious resources. This vulnerability is especially relevant for dynamic parameters.

Affected (1)

Products: Openjsf: Express

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Openjsf Express	From 3.0.0 to 3.21.5

Related CWEs

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

References (1)

https://www.herodevs.com/vulnerability-directory/cve-2024-10491

Source: 36c7be3b-2937-45df-85ea-ca7133ea542c

ExploitThird Party Advisory

Timeline

No history available yet.