GitHub Advisoryadvisory · npm
GHSA-qmm9-x5gr-4gfm Open Redirect in hekto
MEDIUM
Official page ↗
- Aliases
- CVE-2018-3743
- Ecosystem
- npm
- Packages
- hekto
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-601
- Reviewed
- 2020-06-16
Affected packages
• npm hekto: < 0.2.4 → fixed in 0.2.4
Description
Versions of `hekto` before 0.2.4 are vulnerable to open redirect when a domain name is used as part of the `.html` filename.
Recommendation
Update to version 0.2.4 or later.
Related
Alias · CVE (1)
- CVE-2018-3743 Open redirect in hekto <=0.2.3 when target domain name is used as html filename on server. vulnerability
Weakness · CWE (1)
- CWE-601 URL Redirection to Untrusted Site weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-3743 advisory
- https://github.com/herber/hekto/pull/3 web
- https://github.com/herber/hekto/commit/1e5c75f8259ba0daf9b2600db3c246cda1934c46 web
- https://hackerone.com/reports/320693 web
- https://github.com/advisories/GHSA-qmm9-x5gr-4gfm advisory
- https://www.npmjs.com/advisories/669 web