GitHub Advisoryadvisory · npm
GHSA-jgrh-5m3h-9c5f Web Cache Poisoning in find-my-way
MEDIUM
Official page ↗
- Aliases
- CVE-2020-7764
- Ecosystem
- npm
- Packages
- find-my-way
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-444
- Reviewed
- 2020-11-09
Affected packages
• npm find-my-way: < 2.2.5 → fixed in 2.2.5
• npm find-my-way: >= 3.0.0, < 3.0.5 → fixed in 3.0.5
Description
This affects the package find-my-way before 2.2.5, from 3.0.0 and before 3.0.5. It accepts the Accept-Version' header by default, and if versioned routes are not being used, this could lead to a denial of service. Accept-Version can be used as an unkeyed header in a cache poisoning attack.
Related
Alias · CVE (1)
- CVE-2020-7764 This affects the package find-my-way before 2.2.5, from 3.0.0 and before 3.0.5. vulnerability
Weakness · CWE (1)
- CWE-444 Inconsistent Interpretation of HTTP Requests weakness