Description

The uppy npm package < 1.9.3 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacker to scan local or external network or otherwise interact with internal systems.

Remediation

References

https://hackerone.com/reports/786956

Related Vulnerabilities

CVE-2022-31180 Vulnerability in npm package shescape

CVE-2022-41714 Vulnerability in npm package fastest-json-copy

CVE-2017-9805 Vulnerability in maven package org.apache.struts:struts2-core

CVE-2022-2191 Vulnerability in maven package org.eclipse.jetty:jetty-server

CVE-2018-3771 Vulnerability in npm package statics-server

Severity

Critical

Classification

CWE-918 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Issue Tracking Patch Third Party Advisory