CVE-2021-27515 Information

Description

url-parse before 1.5.0 mishandles certain uses of backslash such as http:/ and interprets the URI as a relative path.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Reference

https://github.com/unshiftio/url-parse/pull/197 https://github.com/unshiftio/url-parse/pull/197 https://github.com/unshiftio/url-parse/compare/1.4.7…1.5.0 https://github.com/unshiftio/url-parse/compare/1.4.7…1.5.0 https://github.com/unshiftio/url-parse/commit/d1e7e8822f26e8a49794b757123b51386325b2b0 https://github.com/unshiftio/url-parse/commit/d1e7e8822f26e8a49794b757123b51386325b2b0 https://advisory.checkmarx.net/advisory/CX-2021-4306 url-parse before 1.5.0 mishandles certain uses of backslash such as http:/ and interprets the URI as a relative path. cpe:2.3:a:url-parse_project:url-parse::::::node.js::*

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

NONE

Availability Impact

LOW

Base Score

NONE

Base Severity

5.3