GHSA-9vp3-7qwq-83r9

Source

https://github.com/advisories/GHSA-9vp3-7qwq-83r9

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/03/GHSA-9vp3-7qwq-83r9/GHSA-9vp3-7qwq-83r9.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-9vp3-7qwq-83r9

Aliases

CVE-2021-45851

Published

2022-03-17T00:00:48Z

Modified

2023-11-01T04:56:56.236224Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Server-Side Request Forgery in FUXA

Details

A Server-Side Request Forgery (SSRF) attack in FUXA 1.1.3 can be carried out leading to the obtaining of sensitive information from the server's internal environment and services, often potentially leading to the attacker executing commands on the server.

Database specific

{
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-918"
    ],
    "severity": "HIGH",
    "nvd_published_at": "2022-03-16T10:15:00Z",
    "github_reviewed_at": "2022-03-25T13:33:46Z"
}

References

Affected packages

npm / @frangoteam/fuxa

Package

Name: @frangoteam/fuxa; View open source insights on deps.dev
Purl: pkg:npm/%40frangoteam/fuxa

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

1.1.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/03/GHSA-9vp3-7qwq-83r9/GHSA-9vp3-7qwq-83r9.json"