The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.
References
Configurations
No configuration.
History
21 Nov 2024, 09:08
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/indutny/node-ip/issues/150 - | |
| References | () https://github.com/indutny/node-ip/pull/143 - | |
| References | () https://github.com/indutny/node-ip/pull/144 - |
16 Aug 2024, 14:35
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-941 CWE-918 |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.1 |
28 May 2024, 12:39
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
27 May 2024, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-05-27 20:15
Updated : 2024-11-21 09:08
NVD link : CVE-2024-29415
Mitre link : CVE-2024-29415
CVE.ORG link : CVE-2024-29415
JSON object : View
Products Affected
No product.