PT-2022-8025 · Unknown · Express-Param

Published 2022-12-31 · Updated 2024-05-17 · CVE-2017-20160

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions flitto express-param versions up to 0.x

Description A critical issue affects an unknown part of the file lib/fetchParams.js, leading to improper handling of extra parameters. The manipulation can be initiated remotely. Upgrading to version 1.0.0 addresses this issue.

Recommendations Upgrading to version 1.0.0 is able to address this issue. It is recommended to upgrade the affected component.

Fix

Weakness Enumeration

CWE-235

Related Identifiers

CVE-2017-20160

GHSA-FR54-72WR-CQVQ

Affected Products

Express-Param

References · 11

• https://github.com/flitto/express-param/releases/tag/1.0.0 · Patch
• https://github.com/flitto/express-param/commit/db94f7391ad0a16dcfcba8b9be1af385b25c42db · Patch
• https://github.com/flitto/express-param/pull/19 · Patch
• https://osv.dev/vulnerability/GHSA-fr54-72wr-cqvq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-20160 · Security Note
• https://osv.dev/vulnerability/CVE-2017-20160 · Vendor Advisory
• https://github.com/flitto/express-param · Note
• https://t.me/cvenotify/41080 · Telegram Post
• https://vuldb.com/?ctiid.217149 · Note
• https://t.me/cibsecurity/55676 · Telegram Post
• https://vuldb.com/?id.217149 · Note