Server-Side Request Forgery and Open Redirect in AllTube Download

🗓️ 09 Mar 2022 15:17:31Reported by GitHub Advisory DatabaseType

Server-Side Request Forgery and Open Redirect in AllTube Download. Mitigated by disabling SSRF attack when 'stream' option is disabled and fixed in version 3.0.3

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2022-24739	9 Mar 202200:41	–	circl
CNNVD	AllTube Download 代码问题漏洞	8 Mar 202200:00	–	cnnvd
CVE	CVE-2022-24739	8 Mar 202221:40	–	cve
Cvelist	CVE-2022-24739 Server-Side Request Forgery (SSRF) and URL Redirection to Untrusted Site ('Open Redirect') in alltube	8 Mar 202221:40	–	cvelist
EUVD	EUVD-2022-1353	3 Oct 202520:07	–	euvd
Friends Of PHP	Server-Side Request Forgery (SSRF) and URL Redirection to Untrusted Site ('Open Redirect')	8 Mar 202209:29	–	friendsofphp
NVD	CVE-2022-24739	8 Mar 202222:15	–	nvd
OSV	CVE-2022-24739 Server-Side Request Forgery (SSRF) and URL Redirection to Untrusted Site ('Open Redirect') in alltube	8 Mar 202221:40	–	osv
OSV	GHSA-75P7-527P-W8WP Server-Side Request Forgery and Open Redirect in AllTube Download	9 Mar 202215:17	–	osv
Prion	Server side request forgery (ssrf)	8 Mar 202222:15	–	prion

Vulners

Node

rudloff alltubeRange<3.0.3composer

Source	Link
github	www.github.com/Rudloff/alltube/security/advisories/GHSA-75p7-527p-w8wp
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-24739
github	www.github.com/ytdl-org/youtube-dl/issues/30691
github	www.github.com/Rudloff/alltube/commit/3a4f09dda0a466662a4e52cde674749e0c668e8d
github	www.github.com/Rudloff/alltube/commit/8913f27716400dabf4906a5ad690a5238f73496a
github	www.github.com/Rudloff/alltube/commit/bc14b6e45c766c05757fb607ef8d444cbbfba71a
github	www.github.com/Rudloff/alltube/releases/tag/3.0.3
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/rudloff/alltube/CVE-2022-24739.yaml
github	www.github.com/advisories/GHSA-75p7-527p-w8wp

02 Feb 2024 17:01Current

2.2Low risk

Vulners AI Score2.2

CVSS 24

CVSS 3.16.1 - 7.3

EPSS0.00247

SSVC