Server-Side Request Forgery in @uppy/companion

높음 7.5CVE-2020-8205 · GHSA-9m4x-8w29-r78g · Published 20/07/2020 · updated 17/06/2026

요약

CVE-2020-8205은(는) uppy (transloadit), @uppy/companion에 영향을 주는 높음 (CVSS 7.5) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 1.2%, 전체 취약점의 68.1%보다 높음.
조치: 1.13.2, 2.0.0-alpha.5 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
uppy transloadit	`= 2.0.0< 1.13.2`	`1.13.2`
@uppy/companion npm	`≥ 2.0.0-alpha.0, < 2.0.0-alpha.5< 1.13.2`	`2.0.0-alpha.51.13.2`

Description

The @uppy/companion npm package before versions 1.13.2 and 2.0.0-alpha.5 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacker to scan local or external networks or otherwise interact with internal systems.

NVD description

The uppy npm package < 1.13.2 and < 2.0.0-alpha.5 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacker to scan local or external networks or otherwise interact with internal systems.

References

nvd.nist.gov/vuln/detail/CVE-2020-8205 · ADVISORY
transloadit/uppy#2322 · WEB
hackerone.com/reports/891270 · WEB
transloadit/uppy · WEB

uppy의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free