CVE-2022-0512

Authorization Bypass Through User-Controlled Key in unshiftio/url-parse

State: Published
Severity: 8.8 High
Published: Feb 14, 2022
Updated: Aug 2, 2024
Reserved: Feb 7, 2022

Description

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.6.

Scores

CVSS	Score	Vector	Source
3.0	8.8 High	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	@huntrdev

Weaknesses

CWE-639 Authorization Bypass Through User-Controlled Key

Affected Products

Product	Versions
unshiftio/url-parseunshiftio	before 1.5.6Affected

References

https://huntr.dev/bounties/6d1bc51f-1876-4f5b-a2c2-734e09e8e05b
https://github.com/unshiftio/url-parse/commit/9be7ee88afd2bb04e4d5a1a8da9a389ac13f8c40
[debian-lts-announce] 20230223 [SECURITY] [DLA 3336-1] node-url-parse security updatemailing-list

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.