Authorization Bypass Through User-Controlled Key in url-parse

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2022-0686 · ADVISORY
• unshiftio/url-parse commit d5c6479 · WEB
• unshiftio/url-parse · PACKAGE
• huntr.dev/bounties/55fd06cd-9054-4d80-83be-eb5a454be78c · WEB
• lists.debian.org/debian-lts-announce/2023/02/msg00030.html · WEB
• security.netapp.com/advisory/ntap-20220325-0006 · WEB
• security.netapp.com/advisory/ntap-20220325-0006 · Third Party Advisory

url-parse のその他の脆弱性

• CVE-2022-0691緊急 9.8Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9.
• CVE-2022-0639中 5.3Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.7.
• CVE-2022-0512中 5.3Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.6.
• CVE-2021-3664中 5.3url-parse is vulnerable to URL Redirection to Untrusted Site
• CVE-2021-27515中 5.3url-parse before 1.5.0 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path.