Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.1

Sencha Connect Middleware Allows Cross-Site Scripting Attacks in Node

CVE-2013-7370 · published 6 years ago
Summary

The Sencha Labs Connect middleware in Node.js versions prior to 2.8.1 allows attackers to inject malicious code into web pages. This can happen when a user visits a website that uses the affected middleware. To protect your website, update Node.js to version 2.8.1 or later.

What to do
  • Update dougwilson connect to version 2.8.1.
  • Update sencha connect to version 2.8.1 or later.
Affected software
Ecosystem VendorProductAffected versions
npm dougwilson connect <= 2.8.0
Fix: upgrade to 2.8.1
– redhat openshift 2.0
cpe:2.3:a:redhat:openshift:2.0:*:*:*:enterprise:*:*:*
– sencha connect < 2.8.1
cpe:2.3:a:sencha:connect:*:*:*:*:*:node.js:*:*
– opensuse opensuse 13.1
cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
– debian debian_linux 8.0
9.0
10.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Original advisory text
node-connect before 2.8.1 has XSS in the Sencha Labs Connect middleware
node-connect before 2.8.1 has XSS in the Sencha Labs Connect middleware
References
Severity
6.1 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published11 Dec 2019
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-3fw8-66wf-pr7m · GHSA
CVE-2013-7370 · NVD
Track software like this
Free during beta