CVE-2023-26159

Katalog CVE

CVSS 6.1 · Medium EPSS 0,80%

Kerentanan Improper Input Validation pada follow-redirects follow redirects. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.

Rincian

Terbit di NVD

2 Januari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

EPSS (30 hari)

0,80% peluang dieksploitasi; lebih tinggi dari 55,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/follow-redirects/follow-redirects/pull/236 issue tracking · patch
• https://security.snyk.io/vuln/SNYK-JS-FOLLOWREDIRECTS-6141137 exploit · advisory pihak ketiga
• https://github.com/follow-redirects/follow-redirects/issues/235 exploit · issue tracking
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZZ425BFKNBQ6AK7...
• https://security.netapp.com/advisory/ntap-20241108-0002/