Lucene search

Veracode Vulnerability DatabaseVERACODE:47303

HistoryMay 31, 2024 - 1:34 p.m.

Server Side Request Forgery (SSRF)

2024-05-3113:34:16

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

ssrf

ip vulnerability

categorization

library

access restriction

6.8 Medium

AI Score

Confidence

High

0 Low

EPSS

Percentile

0.0%

JSON

ip is vulnerable to Server Side Request Forgery (SSRF). The vulnerability is due to some IP addresses being improperly categorized via the isPublic, isPrivate, and isLoopback methods, which allows an attacker to perform Server-Side Request Forgery (SSRF) if an application utilizes the library to restrict access based on public/private IP addresses.

CPENameOperatorVersion
iple2.0.1
iple2.0.0
iple2.0.1
iple2.0.0

Name	Operator	Version
ip	le	2.0.1
ip	le	2.0.0
ip	le	2.0.1
ip	le	2.0.0

References

github.com/indutny/node-ip/issues/150

github.com/indutny/node-ip/pull/143

github.com/indutny/node-ip/pull/144