Lucene search
Veracode Vulnerability DatabaseVERACODE:28862HistoryDec 31, 2020 - 7:32 a.m.
Hostname Spoofing
2020-12-3107:32:56
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
13
urijs
hostname spoofing
backslash character
at character
authorization bypass
EPSS
0.001
Percentile
30.8%
urijs is vulnerable to hostname spoofing. The hostname can be spoofed by using a backslash \\ character followed by an @ character, which could potentially allow an attacker to bypass authorization if the hostname is used in security decisions.
References
github.com/advisories/GHSA-3329-pjwv-fjpg
github.com/medialize/URI.js/commit/b02bf037c99ac9316b77ff8bfd840e90becf1155
github.com/medialize/URI.js/pull/233
github.com/medialize/URI.js/pull/403
github.com/medialize/URI.js/releases/tag/v1.19.4
github.com/medialize/URI.js/security/advisories/GHSA-3329-pjwv-fjpg
www.npmjs.com/package/urijs
Related
ibm
ibm
osv
osv
CVE-2020-26291
2020-12-31 00:15:12
Hostname spoofing via backslashes in URL
2020-12-30 23:40:48
prion
prion
Design/Logic Flaw
2020-12-31 00:15:00
cvelist
cvelist
CVE-2020-26291 Hostname spoofing in URI.js
2020-12-30 23:40:16
redhatcve
redhatcve
CVE-2020-26291
2021-01-12 11:24:27
github
github
Hostname spoofing via backslashes in URL
2020-12-30 23:40:48
nodejs
nodejs
Hostname spoofing via backslashes in URL
2021-01-06 19:45:17
nvd
nvd
CVE-2020-26291
2020-12-31 00:15:12
cve
cve
CVE-2020-26291
2020-12-31 00:15:12
redhat
redhat