{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openjsf:express:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "490126A5-34FA-4D46-946F-8612A3E66AB1",
              "versionEndExcluding": "4.20.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openjsf:express:5.0.0:alpha1:*:*:*:node.js:*:*",
              "matchCriteriaId": "50C7D4CD-B4D9-433E-B3FC-AB309FA31CCA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openjsf:express:5.0.0:alpha2:*:*:*:node.js:*:*",
              "matchCriteriaId": "7DFB65DE-73BB-4BB5-84BA-67B187DD2DA9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openjsf:express:5.0.0:alpha3:*:*:*:node.js:*:*",
              "matchCriteriaId": "B709D2E7-2D50-4A90-B000-0DEB55B80682",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openjsf:express:5.0.0:alpha4:*:*:*:node.js:*:*",
              "matchCriteriaId": "E388EA8E-03EF-41C9-98C6-68D96DAF92A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openjsf:express:5.0.0:alpha5:*:*:*:node.js:*:*",
              "matchCriteriaId": "A7D7FA44-E213-4931-A92B-2C46CA1F6EC5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openjsf:express:5.0.0:alpha6:*:*:*:node.js:*:*",
              "matchCriteriaId": "EBFE2596-A7DE-455C-A59A-1B56ACA82D4F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openjsf:express:5.0.0:alpha7:*:*:*:node.js:*:*",
              "matchCriteriaId": "F68E52F1-1A06-45D4-8593-3D5D7EC32330",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openjsf:express:5.0.0:alpha8:*:*:*:node.js:*:*",
              "matchCriteriaId": "0F5FEAD7-A1EB-4FB1-8B15-A717642961F0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openjsf:express:5.0.0:beta1:*:*:*:node.js:*:*",
              "matchCriteriaId": "2CC3B849-8DAF-47E5-A4EB-E93394C7396A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openjsf:express:5.0.0:beta2:*:*:*:node.js:*:*",
              "matchCriteriaId": "6058D4DD-DE9D-4AD9-87A0-22F81C33F81E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openjsf:express:5.0.0:beta3:*:*:*:node.js:*:*",
              "matchCriteriaId": "9852C6CE-F282-4B7D-9690-57E57FAC8B37",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Express.js minimalist web framework for node. In express \u003c 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0."
    },
    {
      "lang": "es",
      "value": "Express.js, el framework web minimalista para Node. En Express anterior a la versi\u00f3n 4.20.0, pasar una entrada de usuario no confiable (incluso despu\u00e9s de desinfectarla) a response.redirect() puede ejecutar c\u00f3digo no confiable. Este problema se solucion\u00f3 en Express 4.20.0."
    }
  ],
  "id": "CVE-2024-43796",
  "lastModified": "2024-09-20T16:07:47.997",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 5.0,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 3.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-09-10T15:15:17.510",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/expressjs/express/commit/54271f69b511fea198471e6ff3400ab805d6b553"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/expressjs/express/security/advisories/GHSA-qw6h-vgh9-j6wx"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "express"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.20.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "express"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0-alpha.1"
            },
            {
              "fixed": "5.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-43796"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-09-10T19:41:04Z",
    "nvd_published_at": "2024-09-10T15:15:17Z",
    "severity": "LOW"
  },
  "details": "### Impact\n\nIn express \u003c4.20.0, passing untrusted user input - even after sanitizing it - to `response.redirect()` may execute untrusted code\n\n### Patches\n\nthis issue is patched in express 4.20.0\n\n### Workarounds\n\nusers are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist\n\n### Details\n\nsuccessful exploitation of this vector requires the following:\n\n1. The attacker MUST control the input to response.redirect()\n1. express MUST NOT redirect before the template appears\n1. the browser MUST NOT complete redirection before:\n1. the user MUST click on the link in the template\n",
  "id": "GHSA-qw6h-vgh9-j6wx",
  "modified": "2024-11-18T16:27:11Z",
  "published": "2024-09-10T19:41:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/expressjs/express/security/advisories/GHSA-qw6h-vgh9-j6wx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43796"
    },
    {
      "type": "WEB",
      "url": "https://github.com/expressjs/express/commit/54271f69b511fea198471e6ff3400ab805d6b553"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/expressjs/express"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L",
      "type": "CVSS_V4"
    }
  ],
  "summary": "express vulnerable to XSS via response.redirect()"
}

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2024-43796 express vulnerable to XSS via response.redirect() - VEX",
        "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-43796.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "express vulnerable to XSS via response.redirect()",
    "tracking": {
      "current_release_date": "2026-02-18T02:25:27.000Z",
      "generator": {
        "date": "2026-02-18T12:16:03.054Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2024-43796",
      "initial_release_date": "2024-09-01T07:00:00.000Z",
      "revision_history": [
        {
          "date": "2024-10-12T00:00:00.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2024-10-15T00:00:00.000Z",
          "legacy_version": "1.1",
          "number": "2",
          "summary": "Added python-tensorboard to Azure Linux 3.0\nAdded reaper to CBL-Mariner 2.0"
        },
        {
          "date": "2026-02-18T02:25:27.000Z",
          "legacy_version": "1.2",
          "number": "3",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "2.0",
                "product": {
                  "name": "CBL Mariner 2.0",
                  "product_id": "17086"
                }
              },
              {
                "category": "product_version",
                "name": "3.0",
                "product": {
                  "name": "Azure Linux 3.0",
                  "product_id": "17084"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003ccbl2 reaper 3.1.1-12",
                "product": {
                  "name": "\u003ccbl2 reaper 3.1.1-12",
                  "product_id": "4"
                }
              },
              {
                "category": "product_version",
                "name": "cbl2 reaper 3.1.1-12",
                "product": {
                  "name": "cbl2 reaper 3.1.1-12",
                  "product_id": "17234"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003ccbl2 reaper 3.1.1-18",
                "product": {
                  "name": "\u003ccbl2 reaper 3.1.1-18",
                  "product_id": "1"
                }
              },
              {
                "category": "product_version",
                "name": "cbl2 reaper 3.1.1-18",
                "product": {
                  "name": "cbl2 reaper 3.1.1-18",
                  "product_id": "19820"
                }
              }
            ],
            "category": "product_name",
            "name": "reaper"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cazl3 python-tensorboard 2.16.2-5",
                "product": {
                  "name": "\u003cazl3 python-tensorboard 2.16.2-5",
                  "product_id": "3"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 python-tensorboard 2.16.2-5",
                "product": {
                  "name": "azl3 python-tensorboard 2.16.2-5",
                  "product_id": "17632"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cazl3 python-tensorboard 2.16.2-6",
                "product": {
                  "name": "\u003cazl3 python-tensorboard 2.16.2-6",
                  "product_id": "2"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 python-tensorboard 2.16.2-6",
                "product": {
                  "name": "azl3 python-tensorboard 2.16.2-6",
                  "product_id": "19693"
                }
              }
            ],
            "category": "product_name",
            "name": "python-tensorboard"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003ccbl2 reaper 3.1.1-12 as a component of CBL Mariner 2.0",
          "product_id": "17086-4"
        },
        "product_reference": "4",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 reaper 3.1.1-12 as a component of CBL Mariner 2.0",
          "product_id": "17234-17086"
        },
        "product_reference": "17234",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 python-tensorboard 2.16.2-5 as a component of Azure Linux 3.0",
          "product_id": "17084-3"
        },
        "product_reference": "3",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 python-tensorboard 2.16.2-5 as a component of Azure Linux 3.0",
          "product_id": "17632-17084"
        },
        "product_reference": "17632",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 python-tensorboard 2.16.2-6 as a component of Azure Linux 3.0",
          "product_id": "17084-2"
        },
        "product_reference": "2",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 python-tensorboard 2.16.2-6 as a component of Azure Linux 3.0",
          "product_id": "19693-17084"
        },
        "product_reference": "19693",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003ccbl2 reaper 3.1.1-18 as a component of CBL Mariner 2.0",
          "product_id": "17086-1"
        },
        "product_reference": "1",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 reaper 3.1.1-18 as a component of CBL Mariner 2.0",
          "product_id": "19820-17086"
        },
        "product_reference": "19820",
        "relates_to_product_reference": "17086"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-43796",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "general",
          "text": "GitHub_M",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "fixed": [
          "17234-17086",
          "17632-17084",
          "19693-17084",
          "19820-17086"
        ],
        "known_affected": [
          "17086-4",
          "17084-3",
          "17084-2",
          "17086-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-43796 express vulnerable to XSS via response.redirect() - VEX",
          "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-43796.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-10-12T00:00:00.000Z",
          "details": "3.1.1-12:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17086-4",
            "17086-1"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        },
        {
          "category": "vendor_fix",
          "date": "2024-10-12T00:00:00.000Z",
          "details": "2.16.2-5:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17084-3",
            "17084-2"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "environmentalsScore": 0.0,
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "temporalScore": 4.7,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "17086-4",
            "17084-3",
            "17084-2",
            "17086-1"
          ]
        }
      ],
      "title": "express vulnerable to XSS via response.redirect()"
    }
  ]
}