Authorization Bypass Through User-Controlled Key in urijs

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2022-0613 · ADVISORY
• medialize/uri.js commit 6ea641c · WEB
• medialize/uri.js · PACKAGE
• huntr.dev/bounties/f53d5c42-c108-40b8-917d-9dad51535083 · WEB
• lists.fedoraproject.org/archives/list/[email protected]/message/MXSSATHALUSXXD2KT6UFZAX7EG4GR332 · WEB
• lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MXSSATHALUSXXD2KT6UFZAX7EG4GR332

uri.js のその他の脆弱性

• CVE-2022-1243中 6.1CRHTLF can lead to invalid protocol extraction potentially leading to XSS in GitHub repository medialize/uri.js prior to 1.19.11.
• CVE-2022-1233中 6.1URL Confusion When Scheme Not Supplied in GitHub repository medialize/uri.js prior to 1.19.11.
• CVE-2022-0868中 6.1Open Redirect in GitHub repository medialize/uri.js prior to 1.19.10.
• CVE-2022-24723中 5.3URI.js is a Javascript URL mutation library. Before version 1.19.9, whitespace characters are not removed from the beginning of the protocol…
• CVE-2021-3647中 6.1URI.js is vulnerable to URL Redirection to Untrusted Site