CVE-2024-27922
Critical
Description
TOMP Bare Server implements the TompHTTP bare server. A vulnerability in versions prior to 2.0.2 relates to insecure handling of HTTP requests by the @tomphttp/bare-server-node package. This flaw potentially exposes the users of the package to manipulation of their web traffic. The impact may vary depending on the specific usage of the package but it can potentially affect any system where this package is in use. The problem has been patched in version 2.0.2. As of time of publication, no specific workaround strategies have been disclosed.
SeverityCritical
CVSS9.8
Exploit probability58. percentile0.8%
ProductTomphttp Tomp Bare Server
PublishedMar 21, 2024
First seenMar 21, 2024
Weakness typeCWE-444CWE-444
How to fix
Update
- tomphttp tomp_bare_server2.0.2 or later
- @tomphttp/bare-server-node2.0.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tomphttp tomp_bare_server | v < 2.0.2 | 2.0.2 |
| @tomphttp/bare-server-nodenpm | v < 2.0.2 | 2.0.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.