CVE-2022-24723
Published: 3 March 2022
URI.js is a Javascript URL mutation library. Before version 1.19.9, whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly. This issue has been patched in version 1.19.9. Removing leading whitespace from values before passing them to URI.parse can be used as a workaround.
Priority
Status
Package | Release | Status |
---|---|---|
node-uri-js Launchpad, Ubuntu, Debian |
focal |
Needs triage
|
impish |
Ignored
(end of life)
|
|
trusty |
Ignored
(end of standard support)
|
|
upstream |
Needs triage
|
|
xenial |
Ignored
(end of standard support)
|
|
jammy |
Needs triage
|
|
kinetic |
Ignored
(end of life, was needs-triage)
|
|
lunar |
Ignored
(end of life, was needs-triage)
|
|
mantic |
Needs triage
|
Severity score breakdown
Parameter | Value |
---|---|
Base score | 5.3 |
Attack vector | Network |
Attack complexity | Low |
Privileges required | None |
User interaction | None |
Scope | Unchanged |
Confidentiality | None |
Integrity impact | Low |
Availability impact | None |
Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24723
- https://github.com/medialize/URI.js/security/advisories/GHSA-gmv4-r438-p67f
- https://github.com/medialize/URI.js/releases/tag/v1.19.9
- https://github.com/medialize/uri.js/commit/86d10523a6f6e8dc4300d99d671335ee362ad316
- https://huntr.dev/bounties/82ef23b8-7025-49c9-b5fc-1bb9885788e5/
- NVD
- Launchpad
- Debian