CVE-2024-37162CWE-209

zsa Generates Error Messages Containing Sensitive Information

Medium · published June 7, 2024

CVSS v3.1
4.0
EPSS
0%
Percentile
20.6
In the wild
Unconfirmed
What it is

zsa is a library for building typesafe server actions in Next.js. All users are impacted. The zsa application transfers the parse error stack from the server to the client in production build mode. This can potentially reveal sensitive information about the server environment, such as the machine username and directory paths. An attacker could exploit this vulnerability to gain unauthorized access to sensitive server information. This information could be used to plan further attacks or gain a deeper understanding of the server infrastructure. This has been patched on `0.3.3`.

The record
Technical detail
CVSS v3.1
4.0 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00292 · 20.6th percentile
Weakness
CWE-209 · Generation of Error Message Containing Sensitive Information
Published
2024-06-07T14:19Z
EPSS history
Timeline
  • 07 JUN 14:19Z
    zsa Generates Error Messages Containing Sensitive Information
    cvelistv5