CVE-2014-6393

The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400 level responses, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via characters in a non-standard encoding.
References
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:openjsf:express:*:*:*:*:*:*:*:*
cpe:2.3:a:openjsf:express:4.0.0:*:*:*:*:*:*:*
cpe:2.3:a:openjsf:express:4.1.0:*:*:*:*:*:*:*
cpe:2.3:a:openjsf:express:4.1.1:*:*:*:*:*:*:*
cpe:2.3:a:openjsf:express:4.1.2:*:*:*:*:*:*:*
cpe:2.3:a:openjsf:express:4.2.0:*:*:*:*:*:*:*
cpe:2.3:a:openjsf:express:4.3.0:*:*:*:*:*:*:*
cpe:2.3:a:openjsf:express:4.3.1:*:*:*:*:*:*:*
cpe:2.3:a:openjsf:express:4.3.2:*:*:*:*:*:*:*
cpe:2.3:a:openjsf:express:4.4.0:*:*:*:*:*:*:*
cpe:2.3:a:openjsf:express:4.4.1:*:*:*:*:*:*:*
cpe:2.3:a:openjsf:express:4.4.2:*:*:*:*:*:*:*
cpe:2.3:a:openjsf:express:4.4.3:*:*:*:*:*:*:*
cpe:2.3:a:openjsf:express:4.4.4:*:*:*:*:*:*:*
cpe:2.3:a:openjsf:express:4.4.5:*:*:*:*:*:*:*

History

30 Jul 2021, 16:36

Type Values Removed Values Added
CPE cpe:2.3:a:expressjs:express:4.1.1:*:*:*:*:*:*:*
cpe:2.3:a:expressjs:express:4.3.0:*:*:*:*:*:*:*
cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*
cpe:2.3:a:expressjs:express:4.2.0:*:*:*:*:*:*:*
cpe:2.3:a:expressjs:express:4.0.0:*:*:*:*:*:*:*
cpe:2.3:a:expressjs:express:4.4.5:*:*:*:*:*:*:*
cpe:2.3:a:expressjs:express:4.1.0:*:*:*:*:*:*:*
cpe:2.3:a:expressjs:express:4.4.1:*:*:*:*:*:*:*
cpe:2.3:a:expressjs:express:4.3.2:*:*:*:*:*:*:*
cpe:2.3:a:expressjs:express:4.4.2:*:*:*:*:*:*:*
cpe:2.3:a:expressjs:express:4.1.2:*:*:*:*:*:*:*
cpe:2.3:a:expressjs:express:4.4.3:*:*:*:*:*:*:*
cpe:2.3:a:expressjs:express:4.4.0:*:*:*:*:*:*:*
cpe:2.3:a:expressjs:express:4.3.1:*:*:*:*:*:*:*
cpe:2.3:a:expressjs:express:4.4.4:*:*:*:*:*:*:*
cpe:2.3:a:openjsf:express:4.4.4:*:*:*:*:*:*:*
cpe:2.3:a:openjsf:express:*:*:*:*:*:*:*:*
cpe:2.3:a:openjsf:express:4.1.0:*:*:*:*:*:*:*
cpe:2.3:a:openjsf:express:4.2.0:*:*:*:*:*:*:*
cpe:2.3:a:openjsf:express:4.4.1:*:*:*:*:*:*:*
cpe:2.3:a:openjsf:express:4.3.1:*:*:*:*:*:*:*
cpe:2.3:a:openjsf:express:4.1.2:*:*:*:*:*:*:*
cpe:2.3:a:openjsf:express:4.4.0:*:*:*:*:*:*:*
cpe:2.3:a:openjsf:express:4.3.2:*:*:*:*:*:*:*
cpe:2.3:a:openjsf:express:4.4.5:*:*:*:*:*:*:*
cpe:2.3:a:openjsf:express:4.3.0:*:*:*:*:*:*:*
cpe:2.3:a:openjsf:express:4.0.0:*:*:*:*:*:*:*
cpe:2.3:a:openjsf:express:4.4.2:*:*:*:*:*:*:*
cpe:2.3:a:openjsf:express:4.1.1:*:*:*:*:*:*:*
cpe:2.3:a:openjsf:express:4.4.3:*:*:*:*:*:*:*

Information

Published : 2017-08-09 18:29

Updated : 2024-02-04 19:29


NVD link : CVE-2014-6393

Mitre link : CVE-2014-6393

CVE.ORG link : CVE-2014-6393


JSON object : View

Products Affected

openjsf

  • express
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')