Every CVE Search/ Get API key

CVE-2018-3717

Cross-Site Scripting in connect

5.4 MediumFix available

CVE-2018-3717 is a medium vulnerability (CVSS 5.4) in Hackerone Connect Node Module, published June 7, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.31%, the 70th percentile. Fixed in connect 2.14.0.

connect node module before 2.14.0 suffers from a Cross-Site Scripting (XSS) vulnerability due to a lack of validation of file in directory.js middleware.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

1.31%Up 0.5 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 5.4

connect node module before 2.14.0 suffers from a Cross-Site Scripting (XSS) vulnerability due to a lack of validation of file in directory.js middleware.

Record
CVE-2018-3717
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0
3.5 LowAV:N/AC:M/Au:S/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE List No score

connect node module before 2.14.0 suffers from a Cross-Site Scripting (XSS) vulnerability due to a lack of validation of file in directory.js middleware.

Record
CVE-2018-3717
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2018-0316 No score

connect node module before 2.14.0 suffers from a Cross-Site Scripting (XSS) vulnerability due to a lack of validation of file in directory.js middleware.

Record
EUVD-2018-0316
Updated
2026-11-03
GitHub AdvisoriesGHSA-rch9-xh7r-mqgw 5.4

Cross-Site Scripting in connect

connect node module before 2.14.0 suffers from a Cross-Site Scripting (XSS) vulnerability due to a lack of validation of file in directory.js middleware.

Record
GHSA-rch9-xh7r-mqgw
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 5.4

connect node module before 2.14.0 suffers from a Cross-Site Scripting (XSS) vulnerability due to a lack of validation of file in directory.js middleware.

Record
CVE-2018-3717
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2018-3717 5.4

connect node module before 2.14.0 suffers from a Cross-Site Scripting (XSS) vulnerability due to a lack of validation of file in directory.js middleware.

Record
DEBIAN-CVE-2018-3717
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
Show 8 moreShow less
OSVGHSA-rch9-xh7r-mqgw 5.4

Cross-Site Scripting in connect

connect node module before 2.14.0 suffers from a Cross-Site Scripting (XSS) vulnerability due to a lack of validation of file in directory.js middleware.

Record
GHSA-rch9-xh7r-mqgw
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVUBUNTU-CVE-2018-3717 5.4

connect node module before 2.14.0 suffers from a Cross-Site Scripting (XSS) vulnerability due to a lack of validation of file in directory.js middleware.

Record
UBUNTU-CVE-2018-3717
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS 3.0
5.4 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVCLSA-2026-1774225190 No score

TuxCare security update for connect (2 CVEs)

TuxCare rebuilt connect to address 2 CVEs. Fixed in 1.9.2-tuxcare.1.

Record
CLSA-2026-1774225190
Updated
2026-11-02
OSVCLSA-2026-1774225191 No score

TuxCare security update for connect (2 CVEs)

TuxCare rebuilt connect to address 2 CVEs. Fixed in 2.6.0-tuxcare.1.

Record
CLSA-2026-1774225191
Updated
2026-11-02
OSVCLSA-2026-1774225192 No score

TuxCare security update for connect (2 CVEs)

TuxCare rebuilt connect to address 2 CVEs. Fixed in 2.7.5-tuxcare.1.

Record
CLSA-2026-1774225192
Updated
2026-11-02
OSVCLSA-2026-1784596288 No score

TuxCare security update for connect (1 CVE)

TuxCare rebuilt connect to address 1 CVE. Fixed in 2.12.0-tuxcare.1.

Record
CLSA-2026-1784596288
Updated
2026-11-02
OSVCLSA-2026-1792476098 No score

TuxCare security update for connect (3 CVEs)

TuxCare rebuilt connect to address 3 CVEs. Fixed in 2.7.11-tuxcare.1.

Record
CLSA-2026-1792476098
Updated
2026-11-02
OSVCLSA-2026-1792508732 No score

TuxCare security update for connect (3 CVEs)

TuxCare rebuilt connect to address 3 CVEs. Fixed in 2.7.10-tuxcare.1.

Record
CLSA-2026-1792508732
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
connect
npm
 before 2.14.0
2.14.0
connect
TuxCare:npm
 1.9.2-tuxcare.0 up to 1.9.2-tuxcare.1, plus listed versions
1.9.2
1.9.2-tuxcare.1
connect
TuxCare:npm
 2.6.0-tuxcare.0 up to 2.6.0-tuxcare.1, plus listed versions
2.6.0
2.6.0-tuxcare.1
connect
TuxCare:npm
 2.7.5-tuxcare.0 up to 2.7.5-tuxcare.1, plus listed versions
2.7.5
2.7.5-tuxcare.1
connect
TuxCare:npm
 2.12.0-tuxcare.0 up to 2.12.0-tuxcare.1, plus listed versions
2.12.0
2.12.0-tuxcare.1
connect
TuxCare:npm
 2.7.11-tuxcare.0 up to 2.7.11-tuxcare.1, plus listed versions
2.7.11
2.7.11-tuxcare.1
connect
TuxCare:npm
 2.7.10-tuxcare.0 up to 2.7.10-tuxcare.1, plus listed versions
2.7.10
2.7.10-tuxcare.1
node-connect
Debian:12
 before 3.0.0-1
3.0.0-1
node-connect
Debian:13
 before 3.0.0-1
3.0.0-1
node-connect
Debian:14
 before 3.0.0-1
3.0.0-1

History

History
WhenChangedSources
2026-11-03affected
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 5 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open