Exploit Report

Computer Security And Bug Information


CVE Title
Published Date2023-03-16T15:15Z
Modified Date2023-03-22T19:32Z
CWE TypeCWE-918
Description** UNSUPPORTED WHEN ASSIGNED ** The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
By clicking these links you will leave this website. We do not endorse and will not be held accountable for any activity on external sites.
Reference URLhttps://doyensec.com/resources/Doyensec_Advisory_RequestSSRF_Q12023.pdf
Reference DescriptionMISC https://doyensec.com/resources/Doyensec_Advisory_RequestSSRF_Q12023.pdf
Reference URLhttps://github.com/request/request/issues/3442
Reference DescriptionMISC https://github.com/request/request/issues/3442
Reference URLhttps://github.com/request/request/pull/3444
Reference DescriptionMISC https://github.com/request/request/pull/3444
TagsExploit Patch Technical Description

This site's data is aggregated programmatically and provided "as is" without any representations or warranties, express or implied. Exploit.report is not affiliated with the The MITRE Corporation, U.S. Department of Homeland Security (DHS), Cybersecurity and Infrastructure Security Agency (CISA), or US government in any way. CVE and the CVE logo are registered trademarks of The MITRE Corporation

© 2022 Exploit.Report | Data | Contact | Privacy Policy | Articles