Skip to content

Open redirect in url-parse

Moderate severity GitHub Reviewed Published Aug 10, 2021

Package

npm url-parse (npm)

Affected versions

< 1.5.2

Patched versions

1.5.2

Description

Overview

Affected versions of npm url-parse are vulnerable to URL Redirection to Untrusted Site.

Impact

Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior.

References

Severity

Moderate
6.1
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses

CVE ID

CVE-2021-3664

GHSA ID

GHSA-hh27-ffr2-f2jc

Source code

Checking history
See something to contribute? Suggest improvements for this vulnerability.