Versions of the package nossrf before 1.0.4 are vulnerable to Server-Side Request Forgery (SSRF) where an attacker can provide a hostname that resolves to a local or reserved IP address space and bypass the SSRF protection mechanism.
References
| Link | Resource |
|---|---|
| https://security.snyk.io/vuln/SNYK-JS-NOSSRF-9510842 | Exploit Third Party Advisory |
| https://security.snyk.io/vuln/SNYK-JS-NOSSRF-9510842 | Exploit Third Party Advisory |
Configurations
History
26 Mar 2025, 15:06
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://security.snyk.io/vuln/SNYK-JS-NOSSRF-9510842 - Exploit, Third Party Advisory | |
| First Time |
Nossrf Project nossrf
Nossrf Project |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.1 |
| CPE | cpe:2.3:a:nossrf_project:nossrf:*:*:*:*:*:*:*:* |
23 Mar 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-23 15:15
Updated : 2025-03-26 15:06
NVD link : CVE-2025-2691
Mitre link : CVE-2025-2691
JSON object : View
Products Affected
nossrf_project
- nossrf
CWE
No CWE.