CVE-2024-21501

mediumpriority · track · 21EPSS 0.010 · 63 %ileDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

1.03% (63rd) EPSS

CVSS 5.3 · medium

Is it mine?

10 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · cert_bund · nvd

EPSS · scored 2026-10-27

Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server.

cvss

Technical severity, 0–10. One row per scoring source.

5.3

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 1.4

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:Psecondary · ENISA EU

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nsecondary · report@snyk.ioexploitability 3.9 · impact 1.4

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nsecondary · OSV

v3.14.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: poc · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-200USCWE-200USCWE-538USCWE-538US

affected products (10)

Products and version ranges known to be affected.

HCL BigFix Server Automationall versionscert_bundDEcpe:/a:hcltech:bigfix:server_automation
HCL BigFix WebUIall versionscert_bundDEcpe:/a:hcltech:bigfix:webui
n/a org.webjars.npm:sanitize-htmlall versionsenisa_euvdEU
n/a org.webjars.npm:sanitize-html0 → *enisa_euvdEU
n/a sanitize-htmlall versionsenisa_euvdEU
n/a sanitize-html0 → 2.12.1enisa_euvdEU
apostrophecms sanitize-html< 2.12.1nvdUScpe:2.3:a:apostrophecms:sanitize-html:*:*:*:*:*:*:*:*
fedoraproject fedora= 39nvdUScpe:2.3:o:fedoraproject:fedora:*:*:*:*:*:*:*:*
fedoraproject fedora= 40nvdUScpe:2.3:o:fedoraproject:fedora:*:*:*:*:*:*:*:*
npm sanitize-html< 2.12.1osvUSpkg:npm/sanitize-html

advisories (3)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2024-0902Red Hat OpenShift: Schwachstelle ermöglicht Offenlegung von InformationenDeutsch2024-04-16csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat OpenShift ausnutzen, um Informationen offenzulegen.
WID-SEC-W-2024-3344HCL BigFix WebUI: Mehrere Open Source SchwachstellenDeutsch2024-11-05csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in HCL BigFix WebU ausnutzen, um die Vertraulichkeit, Verfügbarkeit und Integrität zu gefährden.
GHSA-rm97-x556-q36hsanitize-html Information Exposure vulnerability2024-02-24ghsa · osvUS
Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund nvd osv NVD CVE.org MITRE

published 2024-02-24modified 2026-06-17

references (25)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan