Cross-site scripting in serve-static - CVE-2024-43800
Published: October 8, 2024
Vulnerability identifier: #VU98131
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Green
CVE-ID: CVE-2024-43800
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Affected software:
serve-static
watsonx.data
Software Support app (Android)
Software Support App (iOS)
Data Virtualization (DV) on Cloud Pak for Data (CPD)
Watson Query on Cloud Pak for Data
Guardium Data Security Center (GDSC)
Maximo Application Suite - IoT Component
Maximo Application Suite - Monitor Component
Business Automation Insights
Cognos Analytics Mobile (Android)
Cognos Analytics Mobile (iOS)
Security QRadar EDR
Cognos Dashboards on Cloud Pak for Data
watsonx Assistant Cartridge
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
QRadar Log Source Management App
Db2 Big SQL
IBM Cloud Pak for Security
IBM Cloud Transformation Advisor
IBM Fusion HCI
IBM Watson Knowledge Catalog in Cloud Pak for Data
Splunk User Behavior Analytics (UBA)
IBM Maximo Application Suite - Manage Component
IBM Process Mining
Qradar Advisor
Unified OSS Console Assurance Monitoring (UOCAM)
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Decision Optimization for Cloud Pak for Data
IBM Maximo Application Suite
IBM Cloud Pak for Business Automation
IBM Observability with Instana
QRadar Suite
IBM Security QRadar Analyst Workflow
IBM Cloud Pak System
IBM Edge Application Manager
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
Red Hat OpenShift Serverless
OpenShift Service Mesh
OpenShift Data Foundation (formerly OpenShift Container Storage)
Network Observability plugin for the Openshift Console
Red Hat OpenShift GitOps
QRadar Pulse App
IBM QRadar Data Synchronization App
Event Streams
IBM App Connect Enterprise
serve-static
watsonx.data
Software Support app (Android)
Software Support App (iOS)
Data Virtualization (DV) on Cloud Pak for Data (CPD)
Watson Query on Cloud Pak for Data
Guardium Data Security Center (GDSC)
Maximo Application Suite - IoT Component
Maximo Application Suite - Monitor Component
Business Automation Insights
Cognos Analytics Mobile (Android)
Cognos Analytics Mobile (iOS)
Security QRadar EDR
Cognos Dashboards on Cloud Pak for Data
watsonx Assistant Cartridge
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
QRadar Log Source Management App
Db2 Big SQL
IBM Cloud Pak for Security
IBM Cloud Transformation Advisor
IBM Fusion HCI
IBM Watson Knowledge Catalog in Cloud Pak for Data
Splunk User Behavior Analytics (UBA)
IBM Maximo Application Suite - Manage Component
IBM Process Mining
Qradar Advisor
Unified OSS Console Assurance Monitoring (UOCAM)
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Decision Optimization for Cloud Pak for Data
IBM Maximo Application Suite
IBM Cloud Pak for Business Automation
IBM Observability with Instana
QRadar Suite
IBM Security QRadar Analyst Workflow
IBM Cloud Pak System
IBM Edge Application Manager
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
Red Hat OpenShift Serverless
OpenShift Service Mesh
OpenShift Data Foundation (formerly OpenShift Container Storage)
Network Observability plugin for the Openshift Console
Red Hat OpenShift GitOps
QRadar Pulse App
IBM QRadar Data Synchronization App
Event Streams
IBM App Connect Enterprise
Detailed vulnerability description
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
How to mitigate CVE-2024-43800
Install updates from vendor's website.