5.3

CVE-2024-29042

Exploit

Translate Cache Poisoning Vulnerability

Translate is a package that allows users to convert text to different languages on Node.js and the browser. Prior to version 3.0.0, an attacker controlling the second variable of the `translate` function is able to perform a cache poisoning attack. They can change the outcome of translation requests made by subsequent users. The `opt.id` parameter allows the overwriting of the cache key. If an attacker sets the `id` variable to the cache key that would be generated by another user, they can choose the response that user gets served. Version 3.0.0 fixes this issue.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Francisco ≫ Translate SwPlatformnode.js Version < 3.0.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.65% 0.462
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://github.com/franciscop/translate/commit/7a2bf8b9f05f7c45c09683973ef4d8e995804aa4
Patch
https://github.com/franciscop/translate/commit/cc1ba03078102f83e0503a96f1a081489bb865d3
Patch
https://github.com/franciscop/translate/security/advisories/GHSA-882j-4vj5-7vmj
Vendor Advisory
Exploit