NVD Vulnerability Detail

CVE-2013-7370

Summary	node-connect before 2.8.1 has XSS in the Sencha Labs Connect middleware
Publication Date	Dec. 11, 2019, 11:15 p.m.
Registration Date	Jan. 26, 2021, 3:49 p.m.
Last Update	Nov. 21, 2024, 11 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:redhat:openshift:2.0::::enterprise:::

Configuration2		or higher	or less	more than	less than
cpe:2.3:a:sencha:connect::::::node.js::*					2.8.1

Configuration3		or higher	or less	more than	less than
cpe:2.3:o:opensuse:opensuse:13.1:::::::*

Related information, measures and tools

No	URL	タグ
1	http://www.openwall.com/lists/oss-security/2014/04/21/2	Mailing List Patch Third Party Advisory
2	http://www.openwall.com/lists/oss-security/2014/04/21/2	Mailing List Patch Third Party Advisory
3	http://www.openwall.com/lists/oss-security/2014/05/13/1	Mailing List Third Party Advisory
4	http://www.openwall.com/lists/oss-security/2014/05/13/1	Mailing List Third Party Advisory
5	https://access.redhat.com/security/cve/cve-2013-7370	Third Party Advisory
6	https://access.redhat.com/security/cve/cve-2013-7370	Third Party Advisory
7	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-7370	Issue Tracking Third Party Advisory
8	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-7370	Issue Tracking Third Party Advisory
9	https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-7370	Issue Tracking
10	https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-7370	Issue Tracking
11	https://nodesecurity.io/advisories/methodOverride_Middleware_Reflected_Cross-Site_Scripting	Broken Link Third Party Advisory
12	https://nodesecurity.io/advisories/methodOverride_Middleware_Reflected_Cross-Site_Scripting	Broken Link Third Party Advisory
13	https://security-tracker.debian.org/tracker/CVE-2013-7370	Third Party Advisory
14	https://security-tracker.debian.org/tracker/CVE-2013-7370	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-79	クロスサイト・スクリプティング（XSS）	https://cwe.mitre.org/data/definitions/79.html

JVN Vulnerability Information

node-connect におけるクロスサイトスクリプティングの脆弱性

Title	node-connect におけるクロスサイトスクリプティングの脆弱性
Summary	node-connect には、クロスサイトスクリプティングの脆弱性が存在します。
Possible impacts	情報を取得される、および情報を改ざんされる可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	June 27, 2013, midnight
Registration Date	Dec. 20, 2019, 11:15 a.m.
Last Update	Dec. 20, 2019, 11:15 a.m.

Affected System

レッドハット

Red Hat OpenShift

Debian

Debian GNU/Linux

openSUSE project

openSUSE

Sencha

Connect 2.8.1 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2013-7370	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7370
Debian Security Tracker
2	CVE-2013-7370	https://security-tracker.debian.org/tracker/CVE-2013-7370
National Vulnerability Database (NVD)
3	CVE-2013-7370	https://nvd.nist.gov/vuln/detail/CVE-2013-7370
Red Hat CVE Database
4	CVE-2013-7370	https://access.redhat.com/security/cve/cve-2013-7370

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-79	https://jvndb.jvn.jp/ja/cwe/CWE-79.html

ベンダー情報

No	Name	URL
Bugzilla
1	Bug 875166	https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-7370
GitHub
2	connect	https://github.com/senchalabs/connect
Red Hat Bugzilla
3	Bug 1091166	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-7370

その他

No	Name	URL
関連文書
1	Re: CVE request - node-connect: methodOverride middleware reflected cross-site scripting	http://www.openwall.com/lists/oss-security/2014/04/21/2

Change Log

No	Changed Details	Date of change
1	[2019年12月20日] 掲載	Dec. 20, 2019, 11:15 a.m.