-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability exists because of improper error handling in the HAX CMS NodeJS application, specifically within the listFiles and saveFiles API endpoints. When these endpoints receive a request that is missing expected URL parameters, the application attempts to access properties of an undefined object, which triggers an unhandled TypeError and causes the server to crash.\n\nThe analysis of the provided commit e9773d1996233f9bafb06832b8220ec2a98bab34 confirms the vulnerability in the listFiles function. The patch introduces a check to ensure that req.query and req.query[\'siteName\'] are present before the application tries to access them, thus preventing the crash. The vulnerability description also explicitly mentions that the saveFile function in src/routes/saveFile.js is affected by the same issue. Although the provided patch information from the tool only shows changes for listFiles.js, the commit on GitHub includes a similar fix for saveFile.js. Therefore, it is highly likely that the saveFile function is also vulnerable. An attacker can exploit this vulnerability by sending a crafted request to either of these endpoints, leading to a denial of service for all users of the application.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @haxtheweb/haxcms-nodejs | npm | < 11.0.9 | 11.0.9 |