GHSA-GCV8-GH4R-25X6 Authorization Bypass Through User-Controlled Key in urijs

Attacker can use case-insensitive protocol schemes like HTTP, htTP, HTtp etc. in order to bypass the patch for CVE-2021-3647...

Authorization Bypass Through User-Controlled Key in urijs

Attacker can use case-insensitive protocol schemes like HTTP, htTP, HTtp etc. in order to bypass the patch for CVE-2021-3647...

@accordproject/cicero-cli (>=0.3.4, <=0.22.3-20211027130006), @accordproject/cicero-common (>=0.3.4, <=0.3.12) +473 more potentially affected by CVE-2021-3647 via urijs (>=1.16.1, <=1.19.6)

urijs NPM version =1.16.1, =0.3.4, =0.3.4, =0.3.4, =0.3.4, =0.4.5-20180705184508, =0.11.2-20190326183124, =0.10.2-20190213145246, =0.22.2-20210714131804, =0.0.5-20190507210024, =0.71.8-20190915045234, =0.80.2-20190926121100, =0.80.4-20191003231621, =0.61.2-20190916200303, =0.90.1-20200514190616,...

CVE-2021-3647

URI.js is vulnerable to URL Redirection to Untrusted Site...

CVE-2021-3647

CVE-2021-3647 affects Medialize URI.js (Node.js) and enables URL redirection to untrusted sites due to input/URL parsing validation issues in URI.js. Public details describe an open redirect vulnerability; Nessus/Huntr materials note unpatched deployments and indicate a bypass possibility in patc...