GHSA-x8rq-rc7x-5fg5
Suggest an improvement- Source
- https://github.com/advisories/GHSA-x8rq-rc7x-5fg5
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-x8rq-rc7x-5fg5/GHSA-x8rq-rc7x-5fg5.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-x8rq-rc7x-5fg5
- Aliases
- Published
- 2022-01-06T22:24:35Z
- Modified
- 2023-11-08T04:07:28.233968Z
- Severity
-
- 8.2 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N CVSS Calculator
- Summary
- uppy's companion module is vulnerable to Server-Side Request Forgery (SSRF)
- Details
-
uppy's companion module is vulnerable to Server-Side Request Forgery (SSRF) via IPv4-mapped IPv6 addresses.
- Database specific
{ "severity": "HIGH", "github_reviewed": true, "cwe_ids": [ "CWE-918" ], "github_reviewed_at": "2022-01-06T19:48:36Z", "nvd_published_at": "2022-01-04T18:15:00Z" }- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2022-0086
- https://github.com/transloadit/uppy/pull/3403
- https://github.com/transloadit/uppy/commit/fc137e30a2a3102eb191141f280d5de20dacdf8f
- https://github.com/transloadit/uppy
- https://github.com/transloadit/uppy/releases/tag/uppy%402.3.3
- https://huntr.dev/bounties/c1c03ef6-3f18-4976-a9ad-08c251279122
Affected packages
npm / uppy
Package
- Name
- uppy
- View open source insights on deps.dev
- Purl
- pkg:npm/uppy