CVE-2024-42352

🗓️ 05 Aug 2024 20:38:08Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 90 Views🌐 WEB

Nuxt framework SSRF vulnerability via `nuxt/icon` API allows remote attackers to change request scheme and host, leading to potential sensitive data exposure

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2024-42352	5 Aug 202417:19	–	circl
CNNVD	Nuxt 安全漏洞	5 Aug 202400:00	–	cnnvd
Cvelist	CVE-2024-42352 Server-Side Request Forgery (SSRF) in nuxt-icon	5 Aug 202420:38	–	cvelist
EUVD	EUVD-2024-2564	3 Oct 202520:07	–	euvd
Github Security Blog	Nuxt Icon affected by a Server-Side Request Forgery (SSRF)	5 Aug 202419:49	–	github
NVD	CVE-2024-42352	5 Aug 202421:15	–	nvd
OSV	CVE-2024-42352 Server-Side Request Forgery (SSRF) in nuxt-icon	5 Aug 202420:38	–	osv
OSV	GHSA-CXGV-PX37-4MP2 Nuxt Icon affected by a Server-Side Request Forgery (SSRF)	5 Aug 202419:49	–	osv
Positive Technologies	PT-2024-29889 · Nuxt · Nuxt	5 Aug 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-42352	5 Feb 202502:26	–	redhatcve

NVD

Vulners

Vulnrichment

Node

nuxt nuxtRange<1.4.5

[
  {
    "vendor": "nuxt",
    "product": "icon",
    "versions": [
      {
        "version": "< 1.4.5",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/nuxt/icon/security/advisories/GHSA-cxgv-px37-4mp2

Parameter	Position	Path	Description	CWE
name	path	/api/_nuxt_icon/[name]	SSRF via improper parsing of proxied request path in Nuxt icon API allowing modification of request target by passing a path prefixed with http:, enabling requests to internal hosts.	CWE-918

19 Sep 2024 20:55Current

8.5High risk

Vulners AI Score8.5

CVSS 3.17.5 - 8.6

EPSS0.00085

SSVC

CWE-918