CVEvulnerability

CVE-2022-24723

5.3 MEDIUM Published 2022-03-03 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-03-03
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
Weaknesses
CWE-20

Description

URI.js is a Javascript URL mutation library. Before version 1.19.9, whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly. This issue has been patched in version 1.19.9. Removing leading whitespace from values before passing them to URI.parse can be used as a workaround.

Affected configurations

• uri.js project uri.js (< 1.19.9)

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

Referenced by CWE · observed example (1)

  • CWE-1474 Non-Equivalent Data Transformation weakness

References