DeutschShown in its original language — a full translation is planned for a future version.
IBM App Connect Enterprise: Mehrere Schwachstellen ermöglichen Cross-Site Scripting und Server-Side Request Forgery
view advisory published 2024-09-22
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um einen Cross-Site Scripting und Server-Side Request Forgery-Angriff durchzuführen.
01
describes (4)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-43800US | medium4.7 | — | ||
serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-sta… | ||||
| CVE-2024-43799US | medium4.7 | — | ||
Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue i… | ||||
| CVE-2024-43796US | medium4.7 | — | ||
Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This… | ||||
| CVE-2024-39338US | high7.5 | — | ||
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs. | ||||
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2024:10906 vom 2024-12-10external
- WID-SEC-W-2024-2197 - CSAF Versionself
- WID-SEC-2024-2197 - Portal Versionself
- IBM Security Bulletin vom 2024-09-22external
- IBM Security Bulletin 7176617 vom 2024-11-20external
- IBM Security Bulletin 7176660 vom 2024-11-20external
- IBM Security Bulletin 7184429 vom 2025-03-02external
- IBM Security Bulletin 7184430 vom 2025-03-02external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan