Cross-site scripting in Express - CVE-2024-43796

Vulnerability identifier: #VU97209

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2024-43796

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in response.redirect() method. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Express
IBM Business Automation Workflow
IBM Cloud Pak for Security
IBM Cloud Transformation Advisor
IBM Fusion HCI
IBM Watson Knowledge Catalog in Cloud Pak for Data
Splunk User Behavior Analytics (UBA)
IBM Maximo Application Suite - AI Broker
Oracle Communications Network Analytics Data Director
IBM Process Mining
Qradar Advisor
Unified OSS Console Assurance Monitoring (UOCAM)
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Decision Optimization for Cloud Pak for Data
IBM Maximo Application Suite
IBM Cloud Pak for Business Automation
IBM Observability with Instana
Data Virtualization (DV) on Cloud Pak for Data (CPD)
Watson Query on Cloud Pak for Data
Maximo Application Suite - IoT Component
Maximo Application Suite - Monitor Component
Business Automation Insights
IBM Application Suite - IBM Asset Data Dictionary Component
Truststore Manager
Security QRadar EDR
Cognos Dashboards on Cloud Pak for Data
watsonx Assistant Cartridge
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
QRadar Log Source Management App
Db2 Big SQL
QRadar Suite
IBM Security QRadar Analyst Workflow
IBM Cloud Pak System
IBM Edge Application Manager
JD Edwards EnterpriseOne Tools
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
Cloud Pak for Data
IBM QRadar Data Synchronization App
Event Streams
Communications Unified Assurance
Fedora
Ubuntu
Red Hat OpenShift Serverless
OpenShift Service Mesh
OpenShift Data Foundation (formerly OpenShift Container Storage)
Network Observability plugin for the Openshift Console
Red Hat OpenShift GitOps
QRadar Pulse App
node-express (Ubuntu package)
chromium
IBM App Connect Enterprise

Install updates from vendor's website.

Express - addressed in versions 4.20.0, 5.0.0
Data Virtualization (DV) on Cloud Pak for Data (CPD) - addressed in versions 2.2.8, 3.1.0
QRadar Suite - update to 1.10.27.0
Watson Query on Cloud Pak for Data - update to 2.2.8
IBM Cloud Transformation Advisor - update to 3.10.2
IBM Fusion HCI - update to 2.10.0
IBM Cloud Pak System - update to 2.3.6.0
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.8, 4.8.9, 5.1.1, 5.1.2, 5.1.3
Cloud Pak for Data - update to 5.2
Splunk User Behavior Analytics (UBA) - update to 5.4.2
Maximo Application Suite - IoT Component - addressed in versions 8.7.28, 8.8.24, 9.0.14, 9.1.5
Maximo Application Suite - Monitor Component - addressed in versions 8.10.15, 8.11.13, 9.0.5
IBM Maximo Application Suite - AI Broker - update to 9.0.3
Business Automation Insights - update to 24.0.0.0.2
Red Hat OpenShift Serverless - update to 1
IBM Application Suite - IBM Asset Data Dictionary Component - update to 1.1.13
Truststore Manager - update to 1.6.0
Network Observability plugin for the Openshift Console - update to 1.7.0
Migration Toolkit for Containers - update to 1.8.5
Red Hat OpenShift GitOps - addressed in versions 1.12.6, 1.13.2
IBM Process Mining - update to 2.0.0 IF001
QRadar Pulse App - update to 2.2.15
OpenShift Service Mesh - update to 2.6.2
Qradar Advisor - update to 2.6.6
IBM Security QRadar Analyst Workflow - update to 2.34.0
Unified OSS Console Assurance Monitoring (UOCAM) - update to 3.1.10
IBM QRadar Data Synchronization App - update to 3.2.1
Security QRadar EDR - update to 3.12.13
node-express (Ubuntu package) - addressed in versions 4.1.1~dfsg-1ubuntu0.16.04.1~esm1, 4.1.1~dfsg-1ubuntu0.18.04.1~esm1, 4.17.1-2ubuntu0.1~esm1, 4.17.3+~4.17.13-1ubuntu0.1~esm1, 4.19.2+~cs8.36.21-1ubuntu0.1~esm1, 4.19.2+~cs8.36.26-1ubuntu0.1
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 4.8.8, 5.1.0
OpenShift Data Foundation (formerly OpenShift Container Storage) - addressed in versions 4.14.13, 4.15.9, 4.16.3, 4.16.5, 4.17.0, 4.17.2
Red Hat OpenShift Container Platform - update to 4.17.15
IBM Decision Optimization for Cloud Pak for Data - update to 5.1
Cognos Dashboards on Cloud Pak for Data - update to 5.1
watsonx Assistant Cartridge - update to 5.1.3
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.1.3
QRadar Log Source Management App - update to 7.0.11
Db2 Big SQL - update to 7.8
IBM Maximo Application Suite - addressed in versions 8.10.19, 8.11.16, 9.0.4
Event Streams - update to 11.5.2
IBM App Connect Enterprise - update to 12.0.12.6
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3-IF039, 24.0.0-IF004, 24.0.1
chromium - addressed in versions 128.0.6613.137-1.el8, 128.0.6613.137-1.el9, 128.0.6613.137-1.fc39, 128.0.6613.137-1.fc40, 128.0.6613.137-1.fc41
IBM Observability with Instana - update to 285

• https://github.com/expressjs/express/security/advisories/GHSA-qw6h-vgh9-j6wx
• https://github.com/expressjs/express/commit/54271f69b511fea198471e6ff3400ab805d6b553

• XSS in Express.js framework
• Fedora 39 update for chromium
• Fedora EPEL 8 update for chromium
• Fedora 41 update for chromium
• Fedora EPEL 9 update for chromium
• Fedora 40 update for chromium
• Multiple vulnerabilities in OpenShift Service Mesh 2.6
• Multiple vulnerabilities in IBM Business Automation Workflow
• Multiple vulnerabilities in IBM App Connect Enterprise
• Multiple vulnerabilities in Red Hat OpenShift Serverless
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.16
• Multiple vulnerabilities in IBM Edge Application Manager
• Multiple vulnerabilities in Network Observability plugin for the Openshift Console 1.7
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.13
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.17
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.12
• Multiple vulnerabilities in HPE Unified OSS Console Assurance Monitoring
• Multiple vulnerabilities in IBM Security QRadar EDR
• Multiple vulnerabilities in QRadar Suite Software
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in IBM QRadar Pulse App
• IBM Maximo Application Suite - AI Broker update for expressjs express
• Multiple vulnerabilities in IBM Observability with Instana
• Multiple vulnerabilities in Migration Toolkit for Containers 1.8
• Cross-site scripting in IBM Decision Optimization for Cloud Pak for Data
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.17
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.16
• Multiple vulnerabilities in IBM Security QRadar Analyst Workflow
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.15
• Multiple vulnerabilities in IBM QRadar Log Source Management App
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.14
• IBM Watson Discovery for IBM Cloud Pak for Data update for expressjs express
• Multiple vulnerabilities in IBM Process Mining
• Multiple vulnerabilities in IBM Event Streams
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Multiple vulnerabilities in IBM Business Automation Insights
• IBM Maximo Application Suite - Monitor Component update for expressjs express
• Multiple vulnerabilities in IBM QRadar Data Synchronization App
• Multiple vulnerabilities in QRadar Advisor With Watson for IBM QRadar SIEM
• Multiple vulnerabilities in IBM Data Virtualization on Cloud Pak for Data
• Multiple vulnerabilities in IBM Cognos Dashboards on Cloud Pak for Data
• Multiple vulnerabilities in Communications Unified Assurance
• Multiple vulnerabilities in IBM Maximo Application Suite, IBM Truststore Manager and IBM Asset Data Dictionary Component
• Splunk User Behavior Analytics (UBA) update for third-party components
• IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge update for expressjs express
• Multiple vulnerabilities in IBM Watson Knowledge Catalog
• Multiple vulnerabilities in IBM Fusion
• IBM Cloud Pak for Data update for Express.js
• Ubuntu update for node-express
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in Oracle Communications Network Analytics Data Director
• Multiple vulnerabilities in JD Edwards EnterpriseOne Tools
• Multiple vulnerabilities in IBM Maximo Application Suite - IoT Component
• IBM Big SQL on Cloud Pak for Data update for Express.js