Lucene search
GoogleOSV:GHSA-6GWW-QPM6-MC2GHistoryDec 02, 2021 - 5:51 p.m.
Server-Side Request Forgery in ssrf-agent
2021-12-0217:51:51
Google
osv.dev
6
0.002 Low
EPSS
Percentile
59.4%
The package ssrf-agent before 1.0.5 are vulnerable to Server-side Request Forgery (SSRF) via the defaultIpChecker function. It fails to properly validate if the IP requested is private.
| CPE | Name | Operator | Version |
|---|---|---|---|
| ssrf-agent | lt | 1.0.5 |
References
github.com/welefen/ssrf-agent
github.com/welefen/ssrf-agent/blob/cec2b85fe8886ad6926a247a3e059d8369ec022b/index.js%23L13
github.com/welefen/ssrf-agent/commit/9607175acd0647d821bae4e8fcc3b712aca3fd2d#diff-e727e4bdf3657fd1d798edcd6b099d6e092f8573cba266154583a746bba0f346
nvd.nist.gov/vuln/detail/CVE-2021-23718
security.netapp.com/advisory/ntap-20211203-0005
snyk.io/vuln/SNYK-JS-SSRFAGENT-1584362
Related
prion
prion
Server side request forgery (ssrf)
2021-11-22 17:15:00
nvd
nvd
CVE-2021-23718
2021-11-22 17:15:08
cve
cve
CVE-2021-23718
2021-11-22 17:15:08
veracode
veracode
Server-Side Request Forgery (SSRF)
2021-11-23 03:15:05
github
github
Server-Side Request Forgery in ssrf-agent
2021-12-02 17:51:51
cvelist
cvelist
CVE-2021-23718 Server-side Request Forgery (SSRF)
2021-11-22 00:00:00