Detections
Analytics

SCA: security update for next (GHSA-fr5h-rqp8-mj6g)

high Tenable Self-Hosted Container Security Plugin ID 414669

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Next.js is a React framework that can provide building blocks to create web applications. A Server-Side
 Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions. If the `Host` header is
 modified, and the below conditions are also met, an attacker may be able to make requests that appear to
 be originating from the Next.js application server itself. The required conditions are 1) Next.js is
 running in a self-hosted manner; 2) the Next.js application makes use of Server Actions; and 3) the Server
 Action performs a redirect to a relative path which starts with a `/`. This vulnerability was fixed in
 Next.js `14.1.1`. (CVE-2024-34351)

See Also

https://github.com/advisories/GHSA-fr5h-rqp8-mj6g

Plugin Details

Severity: High

ID: 414669

Version: Revision 1.14

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.73

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N

CVSS Score Source: CVE-2024-34351

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 5/9/2024

Vulnerability Publication Date: 5/9/2024

Reference Information

CVE: CVE-2024-34351

cwe: CWE-918