search

qiangmao / axios

Promise based HTTP client for the browser and node.js
MIT License
38 stars 10 forks source link

CVE-2020-28168 (Medium) detected in axios-0.13.1.js #84

Open mend-bolt-for-github[bot] opened 1 year ago

mend-bolt-for-github[bot] commented 1 year ago

CVE-2020-28168 - Medium Severity Vulnerability

Vulnerable Library - axios-0.13.1.js

Promise based HTTP client for the browser and node.js

Library home page: https://cdnjs.cloudflare.com/ajax/libs/axios/0.13.1/axios.js

Path to dependency file: /test/manual/cors.html

Path to vulnerable library: /test/manual/../../dist/axios.js

Dependency Hierarchy: - :x: **axios-0.13.1.js** (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address.

Publish Date: 2020-11-06

URL: CVE-2020-28168

CVSS 3 Score Details (5.9)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-11-06

Fix Resolution: axios - 0.21.1

Step up your Open Source Security Game with Mend here