uppy's companion module is vulnerable to Server-Side Request Forgery (SSRF)

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2022-0086 · ADVISORY
• transloadit/uppy#3403 · WEB
• transloadit/uppy commit fc137e3 · WEB
• transloadit/uppy · WEB
• transloadit/uppy release [email protected] · WEB
• huntr.dev/bounties/c1c03ef6-3f18-4976-a9ad-08c251279122 · WEB

uppy のその他の脆弱性

• CVE-2022-0528高 7.5Server-Side Request Forgery (SSRF) in GitHub repository transloadit/uppy prior to 3.3.1.
• CVE-2020-8205高 7.5The uppy npm package < 1.13.2 and < 2.0.0-alpha.5 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attac…