GitHub Advisoryadvisory · npm

GHSA-4w2v-q235-vp99 Axios vulnerable to Server-Side Request Forgery

MEDIUM Published 2021-01-04 Modified 2022-09-14 Official page ↗
Aliases
CVE-2020-28168
Ecosystem
npm
Packages
axios
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-918
Reviewed
2021-01-04

Affected packages

• npm axios: < 0.21.1 → fixed in 0.21.1

Description

Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address.

Related

Alias · CVE (1)

  • CVE-2020-28168 Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by… vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References