CVE-2023-26159

2024-01-0205:15:08

CWE-20

CWE-601

snyk

web.nvd.nist.gov

120

cve-2023-26159

package vulnerability

input validation

url handling

information disclosure

phishing attacks

security breaches

CVSS3

7.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P

AI Score

5.9

Confidence

High

EPSS

0.001

Percentile

19.8%

JSON

Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.

Affected configurations

Nvd

Node

follow-redirectsfollow_redirectsRange<1.15.4node.js

CNA Affected

[
  {
    "product": "follow-redirects",
    "versions": [
      {
        "version": "0",
        "lessThan": "1.15.4",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  }
]