CVE-2017-20160

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in flitto express-param up to 0.x. It has been classified as critical. This affects an unknown part of the file lib/fetchParams.js. The manipulation leads to improper handling of extra parameters. It is possible to initiate the attack remotely. Upgrading to version 1.0.0 is able to address this issue. The identifier of the patch is db94f7391ad0a16dcfcba8b9be1af385b25c42db. It is recommended to upgrade the affected component. The identifier VDB-217149 was assigned to this vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-235

Affected software

Vendor	Product	Versions
flitto	express-param	0.x

References

https://github.com/flitto/express-param/commit/db94f7391ad0a16dcfcba8b9be1af385b25c42dbPatch
https://github.com/flitto/express-param/pull/19Patch
https://github.com/flitto/express-param/releases/tag/1.0.0Release Notes
https://vuldb.com/?ctiid.217149Third Party Advisory
https://vuldb.com/?id.217149Third Party Advisory
https://github.com/flitto/express-param/commit/db94f7391ad0a16dcfcba8b9be1af385b25c42dbPatch
https://github.com/flitto/express-param/pull/19Patch
https://github.com/flitto/express-param/releases/tag/1.0.0Release Notes
https://vuldb.com/?ctiid.217149Third Party Advisory
https://vuldb.com/?id.217149Third Party Advisory

Timeline

Published: Dec 31, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-201617.8A vulnerability classified as problematic has been found in rofl0r MacGeiger. Affected is the function dump_wlan_at of the file macgeiger.c CVE-2017-201625.3A vulnerability, which was classified as problematic, has been found in vercel ms up to 1.x. This issue affects the function parse of the fi CVE-2017-201639.8A vulnerability has been found in Red Snapper NView and classified as critical. This vulnerability affects the function mutate of the file s CVE-2017-201646.1A vulnerability was found in Symbiote Seed up to 6.0.2. It has been classified as critical. Affected is the function onBeforeSecurityLogin o CVE-2017-201657.5A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/CVE-2017-201669.8Ecto 2.2.0 lacks a certain protection mechanism associated with the interaction between is_nil and raise.CVE-2017-201676.1A vulnerability, which was classified as problematic, was found in Minichan. This affects an unknown part of the file reports.php. The manip CVE-2017-201689.8A vulnerability was found in jfm-so piWallet. It has been rated as critical. Affected by this issue is some unknown functionality of the fil CVE-2017-201699.8A vulnerability, which was classified as critical, has been found in GGGGGGGG ToN-MasterServer. Affected by this issue is some unknown funct CVE-2017-201709.8A vulnerability was found in ollpu parontalli. It has been classified as critical. Affected is an unknown function of the file httpdocs/inde CVE-2017-201719.8A vulnerability classified as critical has been found in PrivateSky apersistence. This affects an unknown part of the file db/sql/mysqlUtils CVE-2017-201729.8A vulnerability was found in ridhoq soundslike. It has been classified as critical. Affected is the function get_song_relations of the file