CVE-2020-8205

The uppy npm package 1.13.2 and 2.0.0-alpha.5 is vulnerable to a Server-Side Request Forgery SSRF vulnerability, which allows an attacker to scan local or external networks or otherwise interact with internal systems...

Server side request forgery (ssrf)

The uppy npm package 1.13.2 and 2.0.0-alpha.5 is vulnerable to a Server-Side Request Forgery SSRF vulnerability, which allows an attacker to scan local or external networks or otherwise interact with internal systems...

CVE-2020-8205

The uppy npm package 1.13.2 and 2.0.0-alpha.5 is vulnerable to a Server-Side Request Forgery SSRF vulnerability, which allows an attacker to scan local or external networks or otherwise interact with internal systems...

CVE-2020-8205

CVE-2020-8205 affects the uppy npm package prior to 1.13.2 and prior to 2.0.0-alpha.5, introducing a Server-Side Request Forgery (SSRF) vulnerability that can be used to probe local/external networks or interact with internal systems. The issue is associated with the @uppy/companion context in re...

Server-Side Request Forgery (SSRF)

uppy is vulnerable to server-side request forgery SSRF. The fix for CVE-2020-8135 is adequate and a bypass of the host's IP address against a blacklist exists, allowing a remote attacker to perform HTTP requests in the context of the server...

Server-Side Request Forgery

Overview Versions of @uppy/companion prior to 1.9.3 are vulnerable to Server-Side Request Forgery SSRF. The get route passes the user-controlled variable req.body.url to a GET request without sanitizing the value. This allows attackers to inject arbitrary URLs and make GET requests on behalf of t...

uppy npm package server-side request forgery vulnerability

uppy npm package is a file upload package. A server-side request forgery vulnerability exists in versions of uppy npm package prior to 1.9.3, which can be exploited by an attacker to scan local or external networks or interact with internal systems...

CVE-2020-8135

The uppy npm package 1.9.3 is vulnerable to a Server-Side Request Forgery SSRF vulnerability, which allows an attacker to scan local or external network or otherwise interact with internal systems...

CVE-2020-8135

The uppy npm package 1.9.3 is vulnerable to a Server-Side Request Forgery SSRF vulnerability, which allows an attacker to scan local or external network or otherwise interact with internal systems...

CVE-2020-8135

The uppy npm package 1.9.3 is vulnerable to a Server-Side Request Forgery SSRF vulnerability, which allows an attacker to scan local or external network or otherwise interact with internal systems...

CVE-2020-8135

The uppy npm package 1.9.3 is vulnerable to a Server-Side Request Forgery SSRF vulnerability, which allows an attacker to scan local or external network or otherwise interact with internal systems...

CVE-2020-8135

CVE-2020-8135 affects the uppy npm package prior to 1.9.3, where the SSRF flaw exists in the server-side handling. The root cause is the get route passing a user-controlled req.body.url to a GET request without sanitization, enabling an attacker to cause local or external network interactions. Af...

Server-Side Request Forgery (SSRF)

uppy is vulnerable to server-side request forgery. The /get route calls a downloadURL without validating the url parameter, allowing an attacker to perform HTTP requests in the context of the server. This can result in the extracting of information from any internal resource...

Node.js third-party modules: Server Side Request Forgery in Uppy npm module

Hi Team, While we were testing our security engine at Shieldfy https://shieldfy.io, We found a server side request forgery SSRF vulnerability in Uppy npm package. It allows hacker to easily extract inside information from the server or take control of internal services. Module module name: Uppy...

Node.js third-party modules: [uppy] Stored XSS due to crafted SVG file

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! Module: Uppy. Affected version: 0.22.2...