PT-2023-31617 · Hono · Hono

Yusukebe · Publicado 2023-12-14 · Atualizado 2023-12-19 · CVE-2023-50710

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Média

Vetor base

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Hono versions prior to 3.11.7

Description The issue allows clients to override named path parameter values from previous requests when the application is using TrieRouter. This poses a risk that a privileged user may use unintended parameters when deleting REST API resources. TrieRouter is used either explicitly or when the application matches a pattern that is not supported by the default RegExpRouter.

Recommendations For versions prior to 3.11.7, update to version 3.11.7 to fix the issue. As a temporary workaround, avoid using TrieRouter directly.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2023-50710

GHSA-F6GV-HH8J-Q8VQ

Produtos afetados

Hono

Referências · 11

• 🔥 https://github.com/honojs/hono/security/advisories/GHSA-f6gv-hh8j-q8vq · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50710.json · Exploit
• https://github.com/honojs/hono · Nota
• https://github.com/honojs/hono/commit/8e2b6b08518998783f66d31db4f21b1b1eecc4c8 · Correção
• https://github.com/honojs/hono/releases/tag/v3.11.7 · Nota
• https://twitter.com/VulmonFeeds/status/1735380655544975681 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-50710 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-50710 · Nota de Segurança
• https://t.me/cvenotify/64227 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1735354161942716461 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-f6gv-hh8j-q8vq · Aviso do Fabricante