CVE-2022-25839 Information

Description

The package url-js before 2.1.0 are vulnerable to Improper Input Validation due to improper parsing which makes it is possible for the hostname to be spoofed. http://\\\\localhost and http://localhost are the same URL. However the hostname is not parsed as localhost and the backslash is reflected as it is.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Reference

https://github.com/duzun/URL.js/commit/9dc9fcc99baa4cbda24403d81a589e9b0f4121d0 https://snyk.io/vuln/SNYK-JS-URLJS-2414030 The package url-js before 2.1.0 are vulnerable to Improper Input Validation due to improper parsing which makes it is possible for the hostname to be spoofed. http://\\\\localhost and http://localhost are the same URL. However the hostname is not parsed as localhost and the backslash is reflected as it is. cpe:2.3:a:url-js_project:url-js::::::node.js::*

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

NONE

Availability Impact

LOW

Base Score

NONE

Base Severity

5.3