Description

The uppy npm package < 1.13.2 and < 2.0.0-alpha.5 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacker to scan local or external networks or otherwise interact with internal systems.

Remediation

References

https://hackerone.com/reports/891270

Related Vulnerabilities

CVE-2021-32855 Vulnerability in npm package vditor

CVE-2022-31070 Vulnerability in npm package @ffdc/nestjs-proxy

CVE-2021-23632 Vulnerability in npm package git

CVE-2022-32065 Vulnerability in maven package com.ruoyi:ruoyi

CVE-2021-21391 Vulnerability in npm package @ckeditor/ckeditor5-list

Severity

High

Classification

CWE-918 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Exploit Issue Tracking Third Party Advisory