Authorization Bypass

2022-02-1813:09:51

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

40.5%

JSON

url-parse is vulnerable to authorization bypass. The use of User-Controlled Key allows an attacker to transform original invalid URL into a valid one with url.pathname as host.

CPENameOperatorVersion
url-parsele1.5.6
url-parsele1.5.6
node-url-parse:sideq1.4.7+repack-1
node-url-parse:bookwormeq1.5.3-1
url-parsele1.5.6
url-parsele1.5.6
node-url-parse:sideq1.4.7+repack-1
node-url-parse:bookwormeq1.5.3-1
node-url-parse:bustereq1.2.0-2+deb10u1

Name	Operator	Version
url-parse	le	1.5.6
url-parse	le	1.5.6
node-url-parse:sid	eq	1.4.7+repack-1
node-url-parse:bookworm	eq	1.5.3-1
url-parse	le	1.5.6
url-parse	le	1.5.6
node-url-parse:sid	eq	1.4.7+repack-1
node-url-parse:bookworm	eq	1.5.3-1
node-url-parse:buster	eq	1.2.0-2+deb10u1