CVE-2024-51479

Katalog CVE

CVSS 7.5 · High EPSS 4,0%

Kerentanan Improper Authorization pada vercel next.js. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

Next.js is a React framework for building full-stack web applications. In affected versions if a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed for pages directly under the application's root directory. For example: * [Not affected] `https://example.com/` * [Affected] `https://example.com/foo` * [Not affected] `https://example.com/foo/bar`. This issue is patched in Next.js `14.2.15` and later. If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version. There are no official workarounds for this vulnerability.

Rincian

Terbit di NVD

17 Desember 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-285: Improper Authorization
CWE-863: Incorrect Authorization

EPSS (30 hari)

4,0% peluang dieksploitasi; lebih tinggi dari 90,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/vercel/next.js/security/advisories/GHSA-7gfc-8cq8-jh5f advisory vendor
• https://github.com/vercel/next.js/releases/tag/v14.2.15 release notes