In breve
- CVE-2022-25839 è una vulnerabilità MEDIO (CVSS 5.3) che riguarda url-js (url-js project), url-js.
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.85%, superiore al 58.4% delle vulnerabilità.
- Correzione: aggiornare a 2.1.0 o successiva.
| Package | Affected versions | Patched versions |
|---|
| url-js | < 2.1.0
| 2.1.0
|
| url-js npm | < 2.1.0
| 2.1.0
|
Description
The package url-js before 2.1.0 is vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed. http://\\\\localhost and http://localhost are the same URL. However, the hostname is not parsed as localhost, and the backslash is reflected as it is.
NVD description
The package url-js before 2.1.0 are vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed. http://\\\\\\\\localhost and http://localhost are the same URL. However, the hostname is not parsed as localhost, and the backslash is reflected as it is.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free