GitHub Advisoryadvisory · npm

GHSA-84fv-prrc-5ggr Route Validation Bypass in call

MEDIUM Published 2019-02-18 Modified 2020-08-31 Official page ↗
Aliases
CVE-2016-10543
Ecosystem
npm
Packages
call
Severity
Moderate
Weaknesses
CWE-20
Reviewed
2020-06-16

Affected packages

• npm call: >= 2.0.1, < 3.0.2 → fixed in 3.0.2

Description

Affected versions of `call` do not validate empty parameters, which may result in a bypass of route validation rules. Proof of Concept Routing Scheme: ``` /api/{param}/{param2}/details ``` Triggering Request Path: ``` /api/// ``` Recommendation Update to version 3.0.2 or later.

Related

Alias · CVE (1)

  • CVE-2016-10543 call is an HTTP router that is primarily used by the hapi framework. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References