GitHub Advisoryadvisory · npm

GHSA-v82v-rq72-phq9 Server side request forgery in @isomorphic-git/cors-proxy

HIGH Published 2022-01-26 Modified 2022-01-31 Official page ↗
Aliases
CVE-2021-23664
Ecosystem
npm
Packages
@isomorphic-git/cors-proxy
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weaknesses
CWE-918
Reviewed
2022-01-24

Affected packages

• npm @isomorphic-git/cors-proxy: < 2.7.1 → fixed in 2.7.1

Description

The package @isomorphic-git/cors-proxy before 2.7.1 is vulnerable to Server-side Request Forgery (SSRF) due to missing sanitization and validation of the redirection action in middleware.js.

Related

Alias · CVE (1)

  • CVE-2021-23664 The package @isomorphic-git/cors-proxy before 2.7.1 are vulnerable to Server-side Request Forgery (SSRF) due to missing sanitization and… vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References