Vulnerabilities > CVE-2020-26291 - Unspecified vulnerability in Uri.Js Project Uri.Js

CVSS 6.5 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

NONE

Integrity impact

HIGH

Availability impact

NONE

network

low complexity

uri-js-project

NVD

Published: 2020-12-31

Updated: 2024-11-21

Summary

URI.js is a javascript URL mutation library (npm package urijs). In URI.js before version 1.19.4, the hostname can be spoofed by using a backslash (`\`) character followed by an at (`@`) character. If the hostname is used in security decisions, the decision may be incorrect. Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior. For example the URL `https://expected-example.com\@observed-example.com` will incorrectly return `observed-example.com` if using an affected version. Patched versions correctly return `expected-example.com`. Patched versions match the behavior of other parsers which implement the WHATWG URL specification, including web browsers and Node's built-in URL class. Version 1.19.4 is patched against all known payload variants. Version 1.19.3 has a partial patch but is still vulnerable to a payload variant.]

Vulnerable Configurations

Part	Description	Count
Application	Uri.Js_Project Uri.Js Project Uri.Js - Uri.Js Project Uri.Js .1.15.1 Uri.Js Project Uri.Js 1.0.0 Uri.Js Project Uri.Js 1.1.0 Uri.Js Project Uri.Js 1.2.0 Uri.Js Project Uri.Js 1.3.0 Uri.Js Project Uri.Js 1.3.1 Uri.Js Project Uri.Js 1.3.2 Uri.Js Project Uri.Js 1.4.0 Uri.Js Project Uri.Js 1.4.1 Uri.Js Project Uri.Js 1.4.2 Uri.Js Project Uri.Js 1.4.3 Uri.Js Project Uri.Js 1.5.0 Uri.Js Project Uri.Js 1.5.1 Uri.Js Project Uri.Js 1.6.0 Uri.Js Project Uri.Js 1.6.1 Uri.Js Project Uri.Js 1.6.2 Uri.Js Project Uri.Js 1.6.3 Uri.Js Project Uri.Js 1.7.0 Uri.Js Project Uri.Js 1.7.1 Uri.Js Project Uri.Js 1.7.2 Uri.Js Project Uri.Js 1.7.3 Uri.Js Project Uri.Js 1.7.4 Uri.Js Project Uri.Js 1.8.0 Uri.Js Project Uri.Js 1.8.1 Uri.Js Project Uri.Js 1.8.2 Uri.Js Project Uri.Js 1.8.3 Uri.Js Project Uri.Js 1.9.0 Uri.Js Project Uri.Js 1.9.1 Uri.Js Project Uri.Js 1.10.0 Uri.Js Project Uri.Js 1.10.1 Uri.Js Project Uri.Js 1.10.2 Uri.Js Project Uri.Js 1.11.0 Uri.Js Project Uri.Js 1.11.1 Uri.Js Project Uri.Js 1.11.2 Uri.Js Project Uri.Js 1.12.0 Uri.Js Project Uri.Js 1.12.1 Uri.Js Project Uri.Js 1.13.0 Uri.Js Project Uri.Js 1.13.1 Uri.Js Project Uri.Js 1.13.2 Uri.Js Project Uri.Js 1.14.0 Uri.Js Project Uri.Js 1.14.1 Uri.Js Project Uri.Js 1.14.2 Uri.Js Project Uri.Js 1.15.0 Uri.Js Project Uri.Js 1.15.1 Uri.Js Project Uri.Js 1.15.2 Uri.Js Project Uri.Js 1.16.0 Uri.Js Project Uri.Js 1.16.1 Uri.Js Project Uri.Js 1.17.0 Uri.Js Project Uri.Js 1.17.1 Uri.Js Project Uri.Js 1.18.0 Uri.Js Project Uri.Js 1.18.1 Uri.Js Project Uri.Js 1.18.2 Uri.Js Project Uri.Js 1.18.3 Uri.Js Project Uri.Js 1.18.4 Uri.Js Project Uri.Js 1.18.5 Uri.Js Project Uri.Js 1.18.6 Uri.Js Project Uri.Js 1.18.7 Uri.Js Project Uri.Js 1.18.8 Uri.Js Project Uri.Js 1.18.9 Uri.Js Project Uri.Js 1.18.10 Uri.Js Project Uri.Js 1.18.11 Uri.Js Project Uri.Js 1.18.12 Uri.Js Project Uri.Js 1.19.0 Uri.Js Project Uri.Js 1.19.1 Uri.Js Project Uri.Js 1.19.2 Uri.Js Project Uri.Js 1.19.3	67

Summary

Vulnerable Configurations

References