GHSA-jgrh-5m3h-9c5f

Source

https://github.com/advisories/GHSA-jgrh-5m3h-9c5f

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/11/GHSA-jgrh-5m3h-9c5f/GHSA-jgrh-5m3h-9c5f.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-jgrh-5m3h-9c5f

Aliases

CVE-2020-7764

Published

2020-11-09T22:17:13Z

Modified

2025-01-08T07:43:34.503819Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Web Cache Poisoning in find-my-way

Details

This affects the package find-my-way before 2.2.5, from 3.0.0 and before 3.0.5. It accepts the Accept-Version' header by default, and if versioned routes are not being used, this could lead to a denial of service. Accept-Version can be used as an unkeyed header in a cache poisoning attack.

Database specific

{
    "github_reviewed_at": "2020-11-09T22:16:44Z",
    "github_reviewed": true,
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-444"
    ],
    "severity": "MODERATE"
}

References

Affected packages

npm / find-my-way

Package

Name: find-my-way; View open source insights on deps.dev
Purl: pkg:npm/find-my-way

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.2.5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/11/GHSA-jgrh-5m3h-9c5f/GHSA-jgrh-5m3h-9c5f.json"

npm / find-my-way

Package

Name: find-my-way; View open source insights on deps.dev
Purl: pkg:npm/find-my-way

Affected ranges

Type: SEMVER
Events: Introduced

3.0.0

Fixed

3.0.5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/11/GHSA-jgrh-5m3h-9c5f/GHSA-jgrh-5m3h-9c5f.json"