GHSA-pv4c-p2j5-38j4

Suggest an improvement
Source
https://github.com/advisories/GHSA-pv4c-p2j5-38j4
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/08/GHSA-pv4c-p2j5-38j4/GHSA-pv4c-p2j5-38j4.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-pv4c-p2j5-38j4
Aliases
Published
2018-08-13T15:02:15Z
Modified
2026-01-23T17:48:34.551961Z
Severity
  • 10.0 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Open Redirect in url-parse
Details

Versions of url-parse before 1.4.3 returns the wrong hostname which could lead to Open Redirect, Server Side Request Forgery (SSRF), or Bypass Authentication Protocol vulnerabilities.

Recommendation

Update to version 1.4.3 or later.

Database specific 
{
    "github_reviewed_at": "2020-06-16T21:50:04Z",
    "severity": "CRITICAL",
    "cwe_ids": [
        "CWE-425"
    ],
    "nvd_published_at": null,
    "github_reviewed": true
}
References

Affected packages

npm / url-parse

Package

Name
url-parse
View open source insights on deps.dev
Purl
pkg:npm/url-parse

Affected ranges

Type
SEMVER
Events
Introduced
0.1.0
Fixed
1.4.3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/08/GHSA-pv4c-p2j5-38j4/GHSA-pv4c-p2j5-38j4.json"