CVE-2024-34344
Last modified
CVE-2024-34344 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Due to the insufficient validation of the `path` parameter in the NuxtTestComponentWrapper, an attacker can execute arbitrary JavaScript on the server side, which allows them to execute arbitrary commands. EPSS estimates a 0.78% chance of exploitation in the next 30 days.
Description
Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Due to the insufficient validation of the `path` parameter in the NuxtTestComponentWrapper, an attacker can execute arbitrary JavaScript on the server side, which allows them to execute arbitrary commands. Users who open a malicious web page in the browser while running the test locally are affected by this vulnerability, which results in the remote code execution from the malicious web page. Since web pages can send requests to arbitrary addresses, a malicious web page can repeatedly try to exploit this vulnerability, which then triggers the exploit when the test server starts.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Nuxt | Nuxt | >= 3.4.0, < 3.12.4 |
References
- https://github.com/nuxt/nuxt/security/advisories/GHSA-v784-fjjh-f8r4Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-34344?
How severe is CVE-2024-34344?
How do I fix CVE-2024-34344?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-34338Tenda O3V2 with firmware versions V1.0.0.10 and V1.0.0.12 wa…7.2
- CVE-2024-3434A vulnerability classified as critical was found in CP Plus …5.4
- CVE-2024-34340Cacti provides an operational monitoring and fault managemen…9.1
- CVE-2024-34341Trix is a rich text editor. The Trix editor, versions prior …5.4
- CVE-2024-34342react-pdf displays PDFs in React apps. If PDF.js is used to …7.1
- CVE-2024-34343Nuxt is a free and open-source framework to create full-stac…6.1
- CVE-2024-34345The CycloneDX JavaScript library contains the core functiona…8.1
- CVE-2024-34346Deno is a JavaScript, TypeScript, and WebAssembly runtime wi…9
- CVE-2024-34347@hoppscotch/cli is a CLI to run Hoppscotch Test Scripts in C…8.3
- CVE-2024-34349Sylius is an open source eCommerce platform. Prior to 1.12.1…4.8
- CVE-2024-3435A path traversal vulnerability exists in the 'save_settings'…8.4
- CVE-2024-34350Next.js is a React framework that can provide building block…7.5
Are you affected by CVE-2024-34344?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST