GitHub Advisoryadvisory · npm

GHSA-9m4x-8w29-r78g Server-Side Request Forgery in @uppy/companion

HIGH Published 2020-08-13 Modified 2023-09-13 Official page ↗
Aliases
CVE-2020-8205
Ecosystem
npm
Packages
@uppy/companion
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-918
Reviewed
2020-08-13

Affected packages

• npm @uppy/companion: < 1.13.2 → fixed in 1.13.2 • npm @uppy/companion: >= 2.0.0-alpha.0, < 2.0.0-alpha.5 → fixed in 2.0.0-alpha.5

Description

The @uppy/companion npm package before versions 1.13.2 and 2.0.0-alpha.5 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacker to scan local or external networks or otherwise interact with internal systems.

Related

Alias · CVE (1)

  • CVE-2020-8205 The uppy npm package < 1.13.2 and < 2.0.0-alpha.5 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an… vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References