CVE-2022-24723

Katalog CVE

CVSS 5.3 · Medium EPSS 1,9%

Kerentanan Improper Input Validation pada uri.js project uri.js. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

URI.js is a Javascript URL mutation library. Before version 1.19.9, whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly. This issue has been patched in version 1.19.9. Removing leading whitespace from values before passing them to URI.parse can be used as a workaround.

Rincian

Terbit di NVD

3 Maret 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation

EPSS (30 hari)

1,9% peluang dieksploitasi; lebih tinggi dari 79,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/medialize/uri.js/commit/86d10523a6f6e8dc4300d99d671335ee362ad316 patch · advisory pihak ketiga
• https://huntr.dev/bounties/82ef23b8-7025-49c9-b5fc-1bb9885788e5/ exploit · issue tracking · patch · advisory pihak ketiga
• https://github.com/medialize/URI.js/security/advisories/GHSA-gmv4-r438-p67f mitigasi · advisory pihak ketiga
• https://github.com/medialize/URI.js/releases/tag/v1.19.9 release notes · advisory pihak ketiga