CVE-2024-21536

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-21536
Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths.

7.5 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://security.snyk.io/vuln/SNYK-JS-HTTPPROXYMIDDLEWARE-8229906 Third Party Advisory
https://gist.github.com/mhassan1/28be67266d82a53708ed59ce5dc3c94a Exploit Third Party Advisory
https://github.com/chimurai/http-proxy-middleware/commit/788b21e4aff38332d6319557d4a5b1b13b1f9a22 Patch
https://github.com/chimurai/http-proxy-middleware/commit/0b4274e8cc9e9a2c5a06f35fbf456ccfcebc55a5 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:chimurai:http-proxy-middleware:*:*:*:*:*:*:*:*
cpe:2.3:a:chimurai:http-proxy-middleware:*:*:*:*:*:*:*:*
History

01 Nov 2024, 18:03

Type Values Removed Values Added
CWE NVD-CWE-noinfo
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
CPE cpe:2.3:a:chimurai:http-proxy-middleware:*:*:*:*:*:*:*:*
References () https://github.com/chimurai/http-proxy-middleware/commit/788b21e4aff38332d6319557d4a5b1b13b1f9a22 - () https://github.com/chimurai/http-proxy-middleware/commit/788b21e4aff38332d6319557d4a5b1b13b1f9a22 - Patch
References () https://security.snyk.io/vuln/SNYK-JS-HTTPPROXYMIDDLEWARE-8229906 - () https://security.snyk.io/vuln/SNYK-JS-HTTPPROXYMIDDLEWARE-8229906 - Third Party Advisory
References () https://gist.github.com/mhassan1/28be67266d82a53708ed59ce5dc3c94a - () https://gist.github.com/mhassan1/28be67266d82a53708ed59ce5dc3c94a - Exploit, Third Party Advisory
References () https://github.com/chimurai/http-proxy-middleware/commit/0b4274e8cc9e9a2c5a06f35fbf456ccfcebc55a5 - () https://github.com/chimurai/http-proxy-middleware/commit/0b4274e8cc9e9a2c5a06f35fbf456ccfcebc55a5 - Patch
First Time Chimurai http-proxy-middleware
Chimurai

19 Oct 2024, 05:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-10-19 05:15

Updated : 2024-11-01 18:03

NVD link : CVE-2024-21536

Mitre link : CVE-2024-21536

JSON object : View

Products Affected

chimurai

  • http-proxy-middleware
CWE
NVD-CWE-noinfo