GHSA-jchw-25xp-jwwc

Suggest an improvement
Source
https://github.com/advisories/GHSA-jchw-25xp-jwwc
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/01/GHSA-jchw-25xp-jwwc/GHSA-jchw-25xp-jwwc.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-jchw-25xp-jwwc
Aliases
Related
Published
2024-01-02T06:30:30Z
Modified
2024-01-09T19:03:24Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Follow Redirects improperly handles URLs in the url.parse() function
Details

Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.

Database specific 
{
    "nvd_published_at": "2024-01-02T05:15:08Z",
    "cwe_ids": [
        "CWE-20",
        "CWE-601"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-08T22:01:39Z"
}
References

Affected packages

npm / follow-redirects

Package

Name
follow-redirects
View open source insights on deps.dev
Purl
pkg:npm/follow-redirects

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.15.4