Authorization Bypass Through User-Controlled Key in urijs

Description

References

• nvd.nist.gov/vuln/detail/CVE-2022-0613 · ADVISORY
• medialize/uri.js commit 6ea641c · WEB
• medialize/uri.js · PACKAGE
• huntr.dev/bounties/f53d5c42-c108-40b8-917d-9dad51535083 · WEB
• lists.fedoraproject.org/archives/list/[email protected]/message/MXSSATHALUSXXD2KT6UFZAX7EG4GR332 · WEB
• lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MXSSATHALUSXXD2KT6UFZAX7EG4GR332

uri.js의 다른 취약점

• CVE-2022-1243보통 6.1CRHTLF can lead to invalid protocol extraction potentially leading to XSS in GitHub repository medialize/uri.js prior to 1.19.11.
• CVE-2022-1233보통 6.1URL Confusion When Scheme Not Supplied in GitHub repository medialize/uri.js prior to 1.19.11.
• CVE-2022-0868보통 6.1Open Redirect in GitHub repository medialize/uri.js prior to 1.19.10.
• CVE-2022-24723보통 5.3URI.js is a Javascript URL mutation library. Before version 1.19.9, whitespace characters are not removed from the beginning of the protocol…
• CVE-2021-3647보통 6.1URI.js is vulnerable to URL Redirection to Untrusted Site