serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to     redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0. (CVE-2024-43800)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to
    redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0. (CVE-2024-43800)

The version of reaper installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-43800 advisory.

  - serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to     redirect() May execute untrusted code. This issue is patched in serve-static 1.16.0. (CVE-2024-43800)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
229013	Linux Distros Unpatched Vulnerability : CVE-2024-43800	Nessus	Misc.	medium
413958	SCA: security update for serve-static (GHSA-cm22-4g7w-348p)	Tenable Cloud Security	SCA Checks	low
413958	SCA: security update for serve-static (GHSA-cm22-4g7w-348p)	Tenable Self-Hosted Container Security	SCA Checks	low
209172	CBL Mariner 2.0 Security Update: reaper (CVE-2024-43800)	Nessus	MarinerOS Local Security Checks	low

Detections

Analytics

CVE-2024-43800

low

Tenable Plugins

medium

low

low

low