CVE-2024-29042

Katalog CVE

CVSS 5.3 · Medium EPSS 0,65%

Kerentanan Improper Input Validation pada francisco translate. Skor CVSS 3.1 5.3 (Medium) menurut github.com.

Deskripsi (NVD)

Translate is a package that allows users to convert text to different languages on Node.js and the browser. Prior to version 3.0.0, an attacker controlling the second variable of the `translate` function is able to perform a cache poisoning attack. They can change the outcome of translation requests made by subsequent users. The `opt.id` parameter allows the overwriting of the cache key. If an attacker sets the `id` variable to the cache key that would be generated by another user, they can choose the response that user gets served. Version 3.0.0 fixes this issue.

Rincian

Terbit di NVD

22 Maret 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation

EPSS (30 hari)

0,65% peluang dieksploitasi; lebih tinggi dari 49,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/franciscop/translate/security/advisories/GHSA-882j-4vj5-7vmj exploit · advisory vendor
• https://github.com/franciscop/translate/commit/7a2bf8b9f05f7c45c09683973ef4d8e995804aa4 patch
• https://github.com/franciscop/translate/commit/cc1ba03078102f83e0503a96f1a081489bb865d3 patch