Server-Side Request Forgery in @uppy/companion

ALTO 7.5CVE-2020-8205 · GHSA-9m4x-8w29-r78g · Published 20/07/2020 · updated 17/06/2026

In breve

CVE-2020-8205 è una vulnerabilità ALTO (CVSS 7.5) che riguarda uppy (transloadit), @uppy/companion.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.2%, superiore al 68.1% delle vulnerabilità.
Correzione: aggiornare a 1.13.2, 2.0.0-alpha.5 o successiva.

Package	Affected versions	Patched versions
uppy transloadit	`= 2.0.0< 1.13.2`	`1.13.2`
@uppy/companion npm	`≥ 2.0.0-alpha.0, < 2.0.0-alpha.5< 1.13.2`	`2.0.0-alpha.51.13.2`

Description

The @uppy/companion npm package before versions 1.13.2 and 2.0.0-alpha.5 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacker to scan local or external networks or otherwise interact with internal systems.

NVD description

The uppy npm package < 1.13.2 and < 2.0.0-alpha.5 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacker to scan local or external networks or otherwise interact with internal systems.

References

nvd.nist.gov/vuln/detail/CVE-2020-8205 · ADVISORY
transloadit/uppy#2322 · WEB
hackerone.com/reports/891270 · WEB
transloadit/uppy · WEB

Altre vulnerabilità di uppy

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free