Description

The uppy npm package < 1.13.2 and < 2.0.0-alpha.5 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacker to scan local or external networks or otherwise interact with internal systems.

Remediation

References

https://hackerone.com/reports/891270

Related Vulnerabilities

CVE-2020-7631 Vulnerability in npm package diskusage-ng

CVE-2023-50710 Vulnerability in npm package hono

CVE-2020-7760 Vulnerability in npm package codemirror

CVE-2019-14653 Vulnerability in maven package org.webjars.npm:editor.md

CVE-2020-11020 Vulnerability in npm package faye

Severity

High

Classification

CWE-918 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Exploit Issue Tracking Third Party Advisory