PT-2023-4735 · Unknown +2 · @Cyprus/Request +2

🗓️ 16 Mar 2023 00:00:00Reported by Positive TechnologiesType

ptsecurity

ptsecurity🔗 dbugs.ptsecurity.com👁 1 Views

SSRF bypass via cross-protocol redirect in Request up to 2.88.1 and @cyprus/request before 3.0.0.

Reporter	Title	Published	Views	Family All 47
IBM Security Bulletins	Security Bulletin: Automation Assets in IBM Cloud Pak for Integration is vulnerable to Node.js Request module (CVE-2023-28155)	18 May 202312:45	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Eran Hammer cryptiles, PostCSS,Node.js,node-notifier,es5-ext ,MySQL Connectors,json-path and tough-cookie might affect IBM Storage Defender Copy Data Management	12 Dec 202515:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to Node.js Request module denial of service vulnerabilitiy [ CVE-2023-28155]	18 Jul 202314:02	–	ibm
IBM Security Bulletins	Security Bulletin: Decision Optimization for Cloud Pak for Data is vulnerable to a server-side request forgery (CVE-2023-28155).	1 Aug 202316:03	–	ibm
IBM Security Bulletins	Security Bulletin: Astronomer with IBM is vulnerable to several vulnerabilities (CVE-2023-26125, CVE-2023-28155, CVE-2024-29018)	11 Aug 202513:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to server-side request forgery due to [CVE-2023-28155]	27 Jul 202315:56	–	ibm
IBM Security Bulletins	Security Bulletin: The IBM Maximo Application Suite AI-Service component uses multiple third-party dependencies that contain vulnerabilities associated with multiple CVEs.	2 Feb 202604:22	–	ibm
IBM Security Bulletins	Security Bulletin: Netcool Operations Insights 1.6.9 addresses multiple security vulnerabilities.	18 Jul 202313:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Edge Application Manager 4.5.2 addresses the security vulnerabilities listed in the CVEs below.	31 Aug 202316:08	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities affecting Watson Knowledge Catalog for IBM Cloud Pak for Data	5 Jul 202318:31	–	ibm

Source	Link
github	www.github.com/request/request/issues/3442
doyensec	www.doyensec.com/resources/Doyensec_Advisory_RequestSSRF_Q12023.pdf
github	www.github.com/request/request/pull/3444
osv	www.osv.dev/vulnerability/CVE-2023-28155
ubuntu	www.ubuntu.com/security/CVE-2023-28155
cve	www.cve.org/CVERecord
security-tracker	www.security-tracker.debian.org/tracker/CVE-2023-28155
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
osv	www.osv.dev/vulnerability/UBUNTU-CVE-2023-28155
osv	www.osv.dev/vulnerability/GHSA-p8p7-x288-28g6

02 Aug 2024 00:00Current

6.8Medium risk

Vulners AI Score6.8

CVSS 26.4

CVSS 3.16.1

EPSS0.00557

cross protocol redirect request vulnerability outdated versions cyprus package