CVE-2020-28168

 

Published at: - 06-11-2020 09:15

Last modified: - 13-09-2022 11:25

Total changes: - 4

Description

Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

 

Verification logic

 

Reference

• https://github.com/axios/axios/issues/3369
• [druid-commits] 20210107 [GitHub] [druid] jon-wei opened a new pull request #10733: Update deps for CVE-2020-28168 and CVE-2020-28052-Mailing List, Third Party Advisory
• [druid-commits] 20210107 [GitHub] [druid] clintropolis merged pull request #10733: Update deps for CVE-2020-28168 and CVE-2020-28052-Mailing List, Third Party Advisory
• [druid-commits] 20210127 [druid] 01/02: Update deps for CVE-2020-28168 and CVE-2020-28052 (#10733)-Mailing List, Patch, Third Party Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf

 

Keywords

NVD

 

CVE-2020-28168

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures