CVE-2014-6393
NONE EPSS 62.5%
Published Aug 9, 20178y ago · Modified Jun 17, 20262w ago
Published Aug 9, 2017 8y ago
Last Modified Jun 17, 2026 2w ago
Description
The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400 level responses, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via characters in a non-standard encoding.
Threat Intelligence
EPSS Exploit Probability
62.5% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-79 Cross-site Scripting Injection
Affected Products 15
| Vendor | Product | Version | Range |
|---|---|---|---|
| openjsf | express | * | ≤3.10.5 |
| openjsf | express | 4.0.0 | any |
| openjsf | express | 4.1.0 | any |
| openjsf | express | 4.1.1 | any |
| openjsf | express | 4.1.2 | any |
| openjsf | express | 4.2.0 | any |
| openjsf | express | 4.3.0 | any |
| openjsf | express | 4.3.1 | any |
| openjsf | express | 4.3.2 | any |
| openjsf | express | 4.4.0 | any |
| openjsf | express | 4.4.1 | any |
| openjsf | express | 4.4.2 | any |
| openjsf | express | 4.4.3 | any |
| openjsf | express | 4.4.4 | any |
| openjsf | express | 4.4.5 | any |
References 2
- bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=1203190
- nodesecurity.io https://nodesecurity.io/advisories/express-no-charset-in-content-type-header
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.