Kurz gesagt
- CVE-2022-25839 ist eine Schwachstelle (MITTEL (CVSS 5.3)) in url-js (url-js project), url-js.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.85%, höher als bei 58.4% aller Schwachstellen.
- Abhilfe: auf 2.1.0 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| url-js | < 2.1.0
| 2.1.0
|
| url-js npm | < 2.1.0
| 2.1.0
|
Description
The package url-js before 2.1.0 is vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed. http://\\\\localhost and http://localhost are the same URL. However, the hostname is not parsed as localhost, and the backslash is reflected as it is.
NVD description
The package url-js before 2.1.0 are vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed. http://\\\\\\\\localhost and http://localhost are the same URL. However, the hostname is not parsed as localhost, and the backslash is reflected as it is.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free