CVE-2024-27922
Last modified
CVE-2024-27922 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. TOMP Bare Server implements the TompHTTP bare server. A vulnerability in versions prior to 2.0.2 relates to insecure handling of HTTP requests by the @tomphttp/bare-server-node package. EPSS estimates a 0.82% chance of exploitation in the next 30 days.
Description
TOMP Bare Server implements the TompHTTP bare server. A vulnerability in versions prior to 2.0.2 relates to insecure handling of HTTP requests by the @tomphttp/bare-server-node package. This flaw potentially exposes the users of the package to manipulation of their web traffic. The impact may vary depending on the specific usage of the package but it can potentially affect any system where this package is in use. The problem has been patched in version 2.0.2. As of time of publication, no specific workaround strategies have been disclosed.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Tomphttp | Tomp Bare Server | < 2.0.2 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-27922?
How severe is CVE-2024-27922?
How do I fix CVE-2024-27922?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-27917Shopware is an open commerce platform based on Symfony Frame…7.5
- CVE-2024-27918Coder allows oragnizations to provision remote development e…8.2
- CVE-2024-27919Envoy is a cloud-native, open-source edge and service proxy.…7.5
- CVE-2024-2792The Elementor Addon Elements plugin for WordPress is vulnera…6.4
- CVE-2024-27920projectdiscovery/nuclei is a fast and customisable vulnerabi…7.4
- CVE-2024-27921Grav is an open-source, flat-file content management system.…8.8
- CVE-2024-27923Grav is a content management system (CMS). Prior to version …8.8
- CVE-2024-27926RSSHub is an open source RSS feed generator. Starting in ver…6.1
- CVE-2024-27927RSSHub is an open source RSS feed generator. Prior to versio…6.5
- CVE-2024-27928vantage6 is an open-source infrastructure for privacy preser…5.9
- CVE-2024-27929ImageSharp is a managed, cross-platform, 2D graphics library…7.1
- CVE-2024-2793The Visual Website Collaboration, Feedback & Project Managem…7.2
Are you affected by CVE-2024-27922?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST