Veracode Vulnerability DatabaseVERACODE:44924Open Redirect
7.3 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P
6.3 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
20.0%
follow-redirects is vulnerable to Open Redirect. The vulnerability is due to improper input validation of URL’s in the url.parse() function. This issue can be exploited by an attacker to redirect users to malicious page leading to information disclosure or phishing attacks.
| CPE | Name | Operator | Version |
|---|---|---|---|
| follow-redirects | le | 1.15.3 | |
| follow-redirects | le | 1.15.3 | |
| node-follow-redirects:sid | eq | 1.13.0-1 |
References
Related
7.3 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P
6.3 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
20.0%