En bref
- CVE-2022-25839 est une vulnérabilité MOYENNE (CVSS 5.3) touchant url-js (url-js project), url-js.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.85%, plus élevée que 58.4% des vulnérabilités.
- Correctif : mettre à jour vers 2.1.0 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| url-js | < 2.1.0
| 2.1.0
|
| url-js npm | < 2.1.0
| 2.1.0
|
Description
The package url-js before 2.1.0 is vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed. http://\\\\localhost and http://localhost are the same URL. However, the hostname is not parsed as localhost, and the backslash is reflected as it is.
NVD description
The package url-js before 2.1.0 are vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed. http://\\\\\\\\localhost and http://localhost are the same URL. However, the hostname is not parsed as localhost, and the backslash is reflected as it is.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free