Server-side Request Forgery (SSRF)
CVE-2021-23664

8.6HIGH

Key Information:

Vendor

Isomorphic-git

Status
@isomorphic-git/cors-proxy
Vendor
CVE Published:
21 January 2022

What is CVE-2021-23664?

The package @isomorphic-git/cors-proxy before 2.7.1 are vulnerable to Server-side Request Forgery (SSRF) due to missing sanitization and validation of the redirection action in middleware.js.

Affected Version(s)

@isomorphic-git/cors-proxy < 2.7.1

References

https://snyk.io/vuln/SNYK-JS-ISOMORPHICGITCORSPROXY-1734788
x_refsource_MISC
https://github.com/isomorphic-git/cors-proxy/commit/1b1c9...
x_refsource_MISC

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jasmin Landry
.