Medium WID-SEC-2024-2197 4 CVEs

IBM App Connect Enterprise: Mehrere Schwachstellen ermöglichen Cross-Site Scripting und Server-Side Request Forgery

Published Sep 22, 2024 · Updated Jan 25, 2026 · Revision 6 · de-DE

Vendor: IBM Vendor: Red Hat Product: App Connect Enterprise Product: Cognos Analytics Product: Db2 Product: Enterprise Linux Product: QRadar SIEM Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um einen Cross-Site Scripting und Server-Side Request Forgery-Angriff durchzuführen.

Product

IBM App Connect Enterprise kombiniert die branchenbewährten Technologien des IBM Integration Bus mit Cloud-nativen Technologien.

Vulnerabilities 4

Medium 5.0

CVE-2024-43796

express vulnerable to XSS via response.redirect()

Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.

expressjs express kubeflow-pipelines-apiserver kubeflow-centraldashboard Debian Ubuntu Azure Linux Wolfi npm

Sep 10, 2024
Medium 5.0

CVE-2024-43799

send vulnerable to template injection that can lead to XSS

Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0.

pillarjs send thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Azure Linux Wolfi npm

Sep 10, 2024
Medium 5.0

CVE-2024-43800

serve-static affected by template injection that can lead to XSS

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.

expressjs serve-static kubeflow-pipelines-apiserver kubeflow-centraldashboard Debian Ubuntu Azure Linux Wolfi npm

Sep 10, 2024
Medium 4.0

CVE-2024-39338

Server-Side Request Forgery in axios

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.

kubeflow-pipelines-apiserver lerna kubeflow-centraldashboard jitsucom-jitsu-console Debian Ubuntu Wolfi npm

Aug 9, 2024

Revision history

2026-01-25 #6
Neue Updates von IBM aufgenommen
2025-03-02 #5
Neue Updates von IBM aufgenommen
2024-12-09 #4
Neue Updates von Red Hat aufgenommen
2024-11-20 #3
Neue Updates von IBM aufgenommen
2024-11-19 #2
Neue Updates von IBM aufgenommen
2024-09-22 #1
Initiale Fassung

References

IBM Security Bulletin vom 2024-09-22
https://www.ibm.com/support/pages/node/7169586
IBM Security Bulletin 7176617 vom 2024-11-20
https://www.ibm.com/support/pages/node/7176617
IBM Security Bulletin 7176660 vom 2024-11-20
https://www.ibm.com/support/pages/node/7176660
Red Hat Security Advisory RHSA-2024:10906 vom 2024-12-10
https://access.redhat.com/errata/RHSA-2024:10906
IBM Security Bulletin 7184430 vom 2025-03-02
https://www.ibm.com/support/pages/node/7184430
IBM Security Bulletin 7184429 vom 2025-03-02
https://www.ibm.com/support/pages/node/7184429
IBM Security Bulletin 7257987 vom 2026-01-25
https://www.ibm.com/support/pages/node/7257987
IBM Security Bulletin 7257986 vom 2026-01-25
https://www.ibm.com/support/pages/node/7257986
IBM Security Bulletin 7257988 vom 2026-01-25
https://www.ibm.com/support/pages/node/7257988