Bug 1203190 (CVE-2014-6393) - CVE-2014-6393 express: cross-site scripting via content-type header
Summary: CVE-2014-6393 express: cross-site scripting via content-type header
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2014-6393
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1203192 1203191
Blocks: 1203193
TreeView+ depends on / blocked
 
Reported: 2015-03-18 11:31 UTC by Martin Prpič
Modified: 2019-09-29 13:30 UTC (History)
12 users (show)

Fixed In Version: express 3.11, express 4.5
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-04-30 13:08:57 UTC


Attachments (Terms of Use)

Description Martin Prpič 2015-03-18 11:31:35 UTC
The following flaw was found in Express:

Vulnerable versions of express do not specify a charset field in the content-type heade while displaying 400 level response messages. The lack of enforcing user's browser to set correct charset, could be leveraged by an attacker to perform a cross-site scripting attack, using non-standard encodings, like UTF-7.

This flaw is fixed in version 3.11 and 4.5 of Express.

External References:

https://nodesecurity.io/advisories/express-no-charset-in-content-type-header

Comment 1 Martin Prpič 2015-03-18 11:33:07 UTC
Created nodejs-express tracking bugs for this issue:

Affects: fedora-all [bug 1203191]
Affects: epel-6 [bug 1203192]


Note You need to log in before you can comment on or make changes to this bug.