Moole Vulnerability Database

Find real vulnerabilities before they ship

Critical

CVE-2023-42282

The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

VectorNETWORK

PublishedFeb 08, 2024, 17:15

Published Bycve@mitre.org

Base Score

Score9.8

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

ip(npm)2.0.02.0.1N/A

ip(npm)01.1.9N/A

References

https://cosmosofcyberspace.github.io/npm_ip_cve/npm_ip_cve.html
https://github.com/indutny/node-ip/commit/6a3ada9b471b09d5f0f5be264911ab564bf67894
https://huntr.com/bounties/bfc3b23f-ddc0-4ee7-afab-223b07115ed3/
https://security.netapp.com/advisory/ntap-20240315-0008/
https://www.bleepingcomputer.com/news/security/dev-rejects-cve-severity-makes-his-github-repo-read-only/

Weakness Type

CWE-918

CVSS Metrics

Base Score

9.8

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base SeverityCritical

Version

3.1

Attack Vector (AV)

NETWORK