The package url-js before 2.1.0 are vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed. http://\\\\\\\\localhost and http://localhost are the same URL. However, the hostname is not parsed as localhost, and the backslash is reflected as it is.
References
| Link | Resource |
|---|---|
| https://github.com/duzun/URL.js/commit/9dc9fcc99baa4cbda24403d81a589e9b0f4121d0 | Patch Third Party Advisory |
| https://snyk.io/vuln/SNYK-JS-URLJS-2414030 | Exploit Patch Third Party Advisory |
Configurations
History
22 Mar 2022, 19:31
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-20 | |
| CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 5.3 |
| CPE | cpe:2.3:a:url-js_project:url-js:*:*:*:*:*:node.js:*:* | |
| References | (CONFIRM) https://snyk.io/vuln/SNYK-JS-URLJS-2414030 - Exploit, Patch, Third Party Advisory | |
| References | (CONFIRM) https://github.com/duzun/URL.js/commit/9dc9fcc99baa4cbda24403d81a589e9b0f4121d0 - Patch, Third Party Advisory |
11 Mar 2022, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | The package url-js before 2.1.0 are vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed. http://\\\\\\\\localhost and http://localhost are the same URL. However, the hostname is not parsed as localhost, and the backslash is reflected as it is. |
11 Mar 2022, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-03-11 20:15
Updated : 2024-02-04 22:29
NVD link : CVE-2022-25839
Mitre link : CVE-2022-25839
CVE.ORG link : CVE-2022-25839
JSON object : View
Products Affected
url-js_project
- url-js
CWE
CWE-20
Improper Input Validation