CVE-2021-27516 — Improper Input Validation in Project Uri.js

CWE-20 — Improper Input Validation4 documents4 sources
Severity
7.5HIGHNVD
EPSS
0.6%
top 31.96%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Uri.js Project Uri.js
Timeline
PublishedFeb 22
Latest updateMar 1

Description

URI.js (aka urijs) before 1.19.6 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages1 packages

▶NVDuri.js_project/uri.js< 1.19.6

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
OSV
URIjs Hostname spoofing via backslashes in URL↗2021-03-01
▶
GHSA
URIjs Hostname spoofing via backslashes in URL↗2021-03-01
▶

📋Vendor Advisories

1
Red Hat
nodejs-urijs: mishandling certain uses of backslash may lead to confidentiality compromise↗2021-02-22
▶