✕
Request a Demo
Rewterz
Rewterz Threat Alert – Earth Preta aka Mustang Panda APT Group – Active IOCs
March 6, 2024
LEAP 2024: International Cybersecurity Firm Rewterz Launches Regional Headquarters in Riyadh, Saudi Arabia
March 6, 2024

Rewterz Threat Advisory – Multiple Node.js Products Vulnerabilities

Severity

Medium

Analysis Summary

CVE-2024-27295 CVSS:8.2

Node.js Directus package could provide weaker than expected security, caused by accent insensitive email matching resulting in a weak password recovery mechanism. A remote attacker could exploit this vulnerability to launch further attacks on the system.

CVE-2024-27296 CVSS:5.3

Node.js Directus package could allow a remote attacker to obtain sensitive information, caused by the insertion of the version number in the in compiled JS bundles. By sending a specially crafted request, an attacker could exploit this vulnerability to obtain sensitive information, and use this information to launch further attacks against the affected system.

CVE-2024-27298 CVSS:6.5

Node.js parse-server package is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements to view, add, modify or delete information in the back-end database.

Impact

  • Information Gain
  • Data Manipulation 

Indicators Of Compromise

CVE

  • CVE-2024-27295
  • CVE-2024-27296
  • CVE-2024-27298

Affected Vendors

Node.js

Affected Products

  • Directus Directus 10.8.2
  • Node.js parse-server 6.4.0
  • Node.js parse-server 5.6.0
  • Node.js parse-server 6.3.1
  • Node.js parse-server 5.5.6

Remediation

Refer to GIT Repository for patch, upgrade or suggested workaround information.

CVE-2024-27295

CVE-2024-27296

CVE-2024-27298