Authorization Bypass

🗓️ 21 Feb 2022 06:18:22Reported by Veracode Vulnerability DatabaseType

veracode

veracode🔗 sca.analysiscenter.veracode.com👁 21 Views

url-parse authorization bypass vulnerabilit

Reporter	Title	Published	Views	Family All 39
IBM Security Bulletins	Security Bulletin: Mutiple Vulnerabilties in Open Source packages affects IBM Watson Machine Learning Accelerator on Cloud Pak for Data	6 Dec 202316:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security is vulnerable to Using Components with Known Vulnerabilities	25 Jul 202213:54	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in Node.js affect IBM Cloud Pak System	16 Aug 202215:59	–	ibm
IBM Security Bulletins	Security Bulletin: Medium/low severity vulnerabilities in libraries used by IBM Spectrum Discover (libraries of libraries)	27 Apr 202222:51	–	ibm
IBM Security Bulletins	Security Bulletin: High severity vulnerabilities in libraries used by IBM Spectrum Discover (libraries of libraries)	27 Apr 202222:57	–	ibm
Huntr	Authorization Bypass Through User-Controlled Key	17 Feb 202220:30	–	huntr
ATTACKERKB	CVE-2022-0686	20 Feb 202213:15	–	attackerkb
CNNVD	NPM url-parse 安全漏洞	20 Feb 202200:00	–	cnnvd
CNVD	NPM url-parse authorization bypass vulnerability	22 Feb 202200:00	–	cnvd
CVE	CVE-2022-0686	20 Feb 202200:00	–	cve

Vulners

Node

node-url-parse node-url-parseMatch1.4.7+repack-1debian

AND

debian debian_linuxMatch999

OR

node-url-parse node-url-parseMatch1.5.3-1debian

AND

debian debian_linuxMatch12

OR

node-url-parse node-url-parseMatch1.4.7+repack-1debian

AND

debian debian_linuxMatch11

OR

node-url-parse node-url-parseMatch1.2.0-2+deb10u1debian

AND

debian debian_linuxMatch10

OR

url-parse_project url-parseRange0.1.0–1.5.7js

OR

url-parse_project url-parseRange0.1.0–1.5.4js

OR

url-parse_project url-parseMatch1.4.3js

Source	Link
github	www.github.com/unshiftio/url-parse/commit/d5c64791ef496ca5459ae7f2176a31ea53b127e5
huntr	www.huntr.dev/bounties/55fd06cd-9054-4d80-83be-eb5a454be78c/
lists	www.lists.debian.org/debian-lts-announce/2023/02/msg00030.html
huntr	www.huntr.dev/bounties/55fd06cd-9054-4d80-83be-eb5a454be78c
security	www.security.netapp.com/advisory/ntap-20220325-0006/

23 Feb 2023 06:17Current

2.5Low risk

Vulners AI Score2.5

CVSS 36.5 - 9.1

CVSS 26.4

EPSS0.00101

authorization bypass url-parse validation malicious urls user-controlled key software