CVE-2021-3664 - OpenCVE

url-parse is vulnerable to URL Redirection to Untrusted Site

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

AV:N/AC:L/Au:N/C:N/I:P/A:N

Vendors & Products
CPE Configurations

Vendors	Products
Url-parse Project	Url-parse

Configuration 1 [-]

cpe:2.3:a:url-parse_project:url-parse:*:*:*:*:*:node.js:*:*

References

Link	Resource
https://github.com/unshiftio/url-parse/commit/81ab967889b08112d3356e451bf03e6aa0cbb7e0	Patch Third Party Advisory
https://huntr.dev/bounties/1625557993985-unshiftio/url-parse	Exploit Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/02/msg00030.html

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: @huntrdev

Published: 2021-07-26T00:00:00

Updated: 2023-02-23T00:00:00

Reserved: 2021-07-23T00:00:00

Link: CVE-2021-3664

JSON object: View

NVD Information

Status : Modified

Published: 2021-07-26T12:15:08.907

Modified: 2023-02-23T03:15:11.397

Link: CVE-2021-3664

JSON object: View

Redhat Information

No data.

CWE

CWE-601

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:url-parse_project:url-parse:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "F471F069-E069-4A4D-98DE-B4C7EDD5AA8E", "versionEndExcluding": "1.5.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "url-parse is vulnerable to URL Redirection to Untrusted Site"}, {"lang": "es", "value": "url-parse es vulnerable a una Redirecci\u00f3n de URLs a Sitios no Confiables"}], "id": "CVE-2021-3664", "lastModified": "2023-02-23T03:15:11.397", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@huntr.dev", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-07-26T12:15:08.907", "references": [{"source": "security@huntr.dev", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/unshiftio/url-parse/commit/81ab967889b08112d3356e451bf03e6aa0cbb7e0"}, {"source": "security@huntr.dev", "tags": ["Exploit", "Third Party Advisory"], "url": "https://huntr.dev/bounties/1625557993985-unshiftio/url-parse"}, {"source": "security@huntr.dev", "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00030.html"}], "sourceIdentifier": "security@huntr.dev", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "security@huntr.dev", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-601"}], "source": "nvd@nist.gov", "type": "Secondary"}]}