CVE-2013-7371
published 2019-12-11CVE-2013-7371: node-connects before 2.8.2 has cross site scripting in Sencha Labs Connect middleware (vulnerability due to incomplete fix for CVE-2013-7370)
PriorityP425medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
1.44%
70.3th percentile
node-connects before 2.8.2 has cross site scripting in Sencha Labs Connect middleware (vulnerability due to incomplete fix for CVE-2013-7370)
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | connect | >= 0 < 2.8.2 | 2.8.2 |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | node-connect | — | — |
| node-connect | node-connect | >= 0 < 3.3.0-1 | 3.3.0-1 |
| sencha | connect | < 2.8.2 | 2.8.2 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
ghsa6.1MEDIUM
osv6.1MEDIUM
vendor_debian6.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Node Connect Reflected Cross-Site Scripting in Sencha Labs Connect middleware
ghsa·2022-05-05·CVSS 6.1
CVE-2013-7371 [MEDIUM] CWE-79 Node Connect Reflected Cross-Site Scripting in Sencha Labs Connect middleware
Node Connect Reflected Cross-Site Scripting in Sencha Labs Connect middleware
node-connect before 2.8.2 has cross site scripting in Sencha Labs Connect middleware (vulnerability due to incomplete fix for CVE-2013-7370)
### Overview
Connect is a stack of middleware that is executed in order in each request.
The "methodOverride" middleware allows the http post to override the method of the request with the value of the "_method" post key or with the header "x-http-method-override".
Because the user post input was not checked, req.method could contain any kind of value. Because the req.method did not match any common method VERB, connect answered with a 404 page containing the "Cannot `[method]` `[url]`" content. The method was not properly encoded for output in the browser.
### Example
OSV
Node Connect Reflected Cross-Site Scripting in Sencha Labs Connect middleware
osv·2022-05-05·CVSS 6.1
CVE-2013-7371 [MEDIUM] Node Connect Reflected Cross-Site Scripting in Sencha Labs Connect middleware
Node Connect Reflected Cross-Site Scripting in Sencha Labs Connect middleware
node-connect before 2.8.2 has cross site scripting in Sencha Labs Connect middleware (vulnerability due to incomplete fix for CVE-2013-7370)
### Overview
Connect is a stack of middleware that is executed in order in each request.
The "methodOverride" middleware allows the http post to override the method of the request with the value of the "_method" post key or with the header "x-http-method-override".
Because the user post input was not checked, req.method could contain any kind of value. Because the req.method did not match any common method VERB, connect answered with a 404 page containing the "Cannot `[method]` `[url]`" content. The method was not properly encoded for output in the browser.
### Example
OSV
CVE-2013-7371: node-connects before 2
osv·2019-12-11·CVSS 6.1
CVE-2013-7371 [MEDIUM] CVE-2013-7371: node-connects before 2
node-connects before 2.8.2 has cross site scripting in Sencha Labs Connect middleware (vulnerability due to incomplete fix for CVE-2013-7370)
Debian
CVE-2013-7371: node-connect - node-connects before 2.8.2 has cross site scripting in Sencha Labs Connect middl...
vendor_debian·2013·CVSS 6.1
CVE-2013-7371 [MEDIUM] CVE-2013-7371: node-connect - node-connects before 2.8.2 has cross site scripting in Sencha Labs Connect middl...
node-connects before 2.8.2 has cross site scripting in Sencha Labs Connect middleware (vulnerability due to incomplete fix for CVE-2013-7370)
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
No detection rules found.
No public exploits indexed.
http://www.openwall.com/lists/oss-security/2014/04/21/2http://www.openwall.com/lists/oss-security/2014/05/13/1https://access.redhat.com/security/cve/cve-2013-7371https://exchange.xforce.ibmcloud.com/vulnerabilities/92710https://nodesecurity.io/advisories/methodOverride_Middleware_Reflected_Cross-Site_Scriptinghttps://security-tracker.debian.org/tracker/CVE-2013-7371http://www.openwall.com/lists/oss-security/2014/04/21/2http://www.openwall.com/lists/oss-security/2014/05/13/1https://access.redhat.com/security/cve/cve-2013-7371https://exchange.xforce.ibmcloud.com/vulnerabilities/92710https://nodesecurity.io/advisories/methodOverride_Middleware_Reflected_Cross-Site_Scriptinghttps://security-tracker.debian.org/tracker/CVE-2013-7371
2019-12-11
Published