CVE-2024-47764
mediumpriority · track · 0EPSS 0.007 · 55 %ileDEEUUSEPSS · scored 2026-10-27
cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 2.7–6.9
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (5)
Products and version ranges known to be affected.
advisories (4)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2025-0034IBM App Connect Enterprise: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2025-01-08csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in IBM App Connect Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
- WID-SEC-W-2025-0043IBM QRadar SIEM (Log Source Management App): Mehrere SchwachstellenDeutsch2025-01-12csaf · cert_bundDE
Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um einen Cross-Site-Scripting-Angriff zu starten, beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu erzeugen, Daten zu manipulieren, vertrauliche Informationen offenzulegen und Sicherheitsmaßnahmen zu umgehen.
- WID-SEC-W-2025-0705HCL BigFix WebUI-Anwendungen: Mehrere SchwachstellenDeutsch2025-04-03csaf · cert_bundDE
Ein entfernter anonymer oder lokaler Angreifer kann mehrere Schwachstellen in HCL BigFix ausnutzen, um Dateien zu manipulieren, erhöhte Privilegien zu erlangen, einen Denial-of-Service-Zustand auszulösen, vertrauliche Informationen offenzulegen und beliebigen Code auszuführen.
- GHSA-pxg6-pf52-xh8xcookie accepts cookie name, path, and domain with out of bounds characters2024-10-04ghsa · osvUS
### Impact The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. For example, `serialize("userName=<script>alert('XSS3')</script>; Max-Age=2592000; a", value)` would result in `"userName=<script>alert('XSS3')</script>; Max-Age=2592000; a=test"`, setting `userName` cookie to `<script>` and ignoring `value`. A similar escape can be used for `path` and `domain`, which could be abused to alter other fields of the cookie. ### Patches Upgrade to 0.7.0, which updates the validation for `name`, `path`, and `domain`. ### Workarounds Avoid passing untrusted or arbitrary values for these fields, ensure they are set by the application instead of user input. ### References * https://github.com/jshttp/cookie/pull/167
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (11)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2024-47764cnnvd
- https://cxsecurity.com/cveshow/CVE-2024-47764/cnnvd
- https://github.com/jscnnvd
- https://github.com/jshttp/cookie/releases/tag/v0.7.2Patchcnnvd
- https://vigilance.fr/vulnerability/Node-js-cookie-Cross-Site-Scripting-dated-09-10-2024-45348cnnvd
- https://github.com/jshttp/cookie/commit/e10042845354fea83bd8f34af72475eed1dadf5cenisa_euvd
- https://github.com/jshttp/cookie/pull/167enisa_euvd
- https://github.com/jshttp/cookie/security/advisories/GHSA-pxg6-pf52-xh8xenisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan