~ / search / GHSA-gcv8-gh4r-25x6

GHSA-gcv8-gh4r-25x6

Authorization Bypass Through User-Controlled Key in urijs

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-0613

Packages

EcosystemPackageAffectedFixed in
npm urijs < 1.19.8 1.19.8

Details

As written in the advisory (Markdown source, shown as plain text).

Attacker can use case-insensitive protocol schemes like HTTP, htTP, HTtp etc. in order to bypass the patch for CVE-2021-3647.

References

External links from the advisory. They lead to third-party sites.