Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2017-20160

Good to know:

icon
icon

Date: December 31, 2022

A vulnerability was found in flitto express-param up to 0.x. It has been classified as critical. This affects an unknown part of the file lib/fetchParams.js. The manipulation leads to improper handling of extra parameters. It is possible to initiate the attack remotely. Upgrading to version 1.0.0 is able to address this issue. The identifier of the patch is db94f7391ad0a16dcfcba8b9be1af385b25c42db. It is recommended to upgrade the affected component. The identifier VDB-217149 was assigned to this vulnerability.

Language: JS

Severity Score

Related Resources (7)

https://vuldb.com/?ctiid.217149
https://vuldb.com/?id.217149
https://github.com/flitto/express-param/pull/19
https://github.com/flitto/express-param/commit/db94f7391ad0a16dcfcba8b9be1af385b25c42db
https://nvd.nist.gov/vuln/detail/CVE-2017-20160
https://github.com/flitto/express-param/releases/tag/1.0.0
https://www.mend.io/vulnerability-database/CVE-2017-20160

Severity Score

Weakness Type (CWE)

Improper Handling of Extra Parameters

CWE-235

Top Fix

icon

Upgrade Version

Upgrade to version express-param - 1.0.0

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): REQUIRED
Scope (S): CHANGED
Confidentiality (C): LOW
Integrity (I): LOW
Availability (A): NONE

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): LOW
Authentication (AU): SINGLE
Confidentiality (C): NONE
Integrity (I): PARTIAL
Availability (A): NONE
Additional information:

Do you need more information?

Contact Us