CVE-2015-1164

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

2.62%

Published

Jan 21, 2015

Modified

May 6, 2026

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Open redirect vulnerability in the serve-static plugin before 1.7.2 for Node.js, when mounted at the root, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a // (slash slash) followed by a domain in the PATH_INFO to the default URI.

Affected Products (1)

serve-static_project · serve-staticvulnerable

References (10)

http://nodesecurity.io/advisories/serve-static-open-redirect

http://www.securityfocus.com/bid/72064

https://bugzilla.redhat.com/show_bug.cgi?id=1181917

https://exchange.xforce.ibmcloud.com/vulnerabilities/99936

https://github.com/expressjs/serve-static/issues/26

http://nodesecurity.io/advisories/serve-static-open-redirect

http://www.securityfocus.com/bid/72064

https://bugzilla.redhat.com/show_bug.cgi?id=1181917

https://exchange.xforce.ibmcloud.com/vulnerabilities/99936

https://github.com/expressjs/serve-static/issues/26

KEV Catalog EPSS Scores Vendors All CVEs