Open Redirect Affecting st package, versions <1.2.2
Threat Intelligence
Exploit Maturity
Mature
EPSS
0.11% (45th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID npm:st:20171013
- published 15 Oct 2017
- disclosed 13 Oct 2017
- credit Xin Gao
Introduced: 13 Oct 2017
CVE-2017-16224 Open this link in a new tabOverview
st is a module for serving static files.
Affected versions of this package are vulnerable to Open Redirect. A malicious user could send a specially crafted request, which would automatically redirect the request to another domain, controlled by the attacker.
Note: st will only redirect if requests are served from the root(/) and not from a subdirectory
References
CVSS Scores
version 3.1