Vulnerabilities > CVE-2023-42282 - Server-Side Request Forgery (SSRF) vulnerability in Fedorindutny IP

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

fedorindutny

CWE-918

critical

NVD

Published: 2024-02-08

Updated: 2024-03-15

Summary

The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

Vulnerable Configurations

Part	Description	Count
Application	Fedorindutny Fedorindutny IP 0.0.1 Fedorindutny IP 0.0.2 Fedorindutny IP 0.0.3 Fedorindutny IP 0.0.4 Fedorindutny IP 0.0.5 Fedorindutny IP 0.1.0 Fedorindutny IP 0.2.0 Fedorindutny IP 0.3.0 Fedorindutny IP 0.3.1 Fedorindutny IP 0.3.2 Fedorindutny IP 0.3.3 Fedorindutny IP 0.3.4 Fedorindutny IP 1.0.0 Fedorindutny IP 1.0.1 Fedorindutny IP 1.0.2 Fedorindutny IP 1.1.0 Fedorindutny IP 1.1.1 Fedorindutny IP 1.1.2 Fedorindutny IP 1.1.4 Fedorindutny IP 1.1.5 Fedorindutny IP 1.1.6 Fedorindutny IP 1.1.7 Fedorindutny IP 1.1.8 Fedorindutny IP 2.0.0	24

Common Weakness Enumeration (CWE)

CWE-918 - Server-Side Request Forgery (SSRF)

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References