-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability lies in the unauthenticated exposure of HAX CMS site listings. The primary evidence comes from the commit 06c2e1fbb7131a8fe66aa0600f38dcacae6b7ac7.
api/services/stats/haxPsuUsage.js: The handler function in this file was modified. Before the patch, it directly returned all data fetched from process.env.HAX_STATS. The vulnerability description confirms this endpoint (/api/services/stats/haxPsuUsage) disclosed a full list of websites. The patch changed the response to only include data.overall, thus redacting the detailed site list. This directly points to the handler function as being vulnerable in its pre-patch state.
api/community/haxPsuStats.js: This entire file, which also contained a handler function, was removed in the same commit. The code in this file fetched data from process.env.HAX_STATS and generated links to sites. Its removal as part of the security fix implies it was another endpoint contributing to the information disclosure, likely by also providing site listings or related sensitive data without authentication.
Both handler functions were responsible for processing requests to their respective API endpoints and returning data that included sensitive site information without proper access controls, making them the vulnerable functions.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @haxtheweb/open-apis | npm | <= 10.0.1 |
KEV Misses 88% of Exploited CVEs- Get the report