Russian Vulnerability Scanner Database

Back to List

CVE-2024-34351

Scores

EPSS

0.928high92.8%
0%20%40%60%80%100%

Percentile: 92.8%

CVSS

7.5high3.x
0246810

CVSS Score: 7.5/10

All CVSS Scores

CVSS 3.x
7.5

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Description

Next.js is a React framework that can provide building blocks to create web applications. A Server-Side Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions. If the Host header is modified, and the below conditions are also met, an attacker may be able to make requests that appear to be originating from the Next.js application server itself. The required conditions are 1) Next.js is running in a self-hosted manner; 2) the Next.js application makes use of Server Actions; and 3) the Server Action performs a redirect to a relative path which starts with a /. This vulnerability was fixed in Next.js 14.1.1.

Scaner-VS 7 — a modern vulnerability management solution

Uses this database for vulnerability detection. High-speed search, cross-platform, advanced configuration audit, and flexible filtering. Suitable for organizations of any size.
Learn more about Scaner-VS 7

Sources

anchore_overridesnvd

CWEs

CWE-918

Exploits

Exploit ID: CVE-2024-34351

Source: github-poc

URL: https://github.com/God4n/nextjs-CVE-2024-34351-_exploit

Vulnerable Software (2)

Type: Configuration

Operating System:

Trait: 
{  "children": [    {      "cpe_match": [        {          "cpe23uri": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",          "versionEndExcluding": "14.1.1",          "versionStartIncludi...

Source: anchore_overrides

Type: Configuration

Vendor: *

Product: next.js

Operating System: * * *

Trait: 
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",      "versionEndExcluding": "14.1.1",      "versionStartIncluding": "13.4.0",      "vulnerable": true  ...

Source: nvd

End of list