CVE-2021-45851 – @frangoteam/fuxa

Package

Manager: npm
Name: @frangoteam/fuxa
Vulnerable Version: >=0 <=1.1.3

Severity

Level: High

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS: 0.00875 pctl0.7442

Details

Server-Side Request Forgery in FUXA A Server-Side Request Forgery (SSRF) attack in FUXA 1.1.3 can be carried out leading to the obtaining of sensitive information from the server's internal environment and services, often potentially leading to the attacker executing commands on the server.

Metadata

Created: 2022-03-17T00:00:48Z
Modified: 2022-03-25T13:33:46Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/03/GHSA-9vp3-7qwq-83r9/GHSA-9vp3-7qwq-83r9.json
CWE IDs: ["CWE-918"]
Alternative ID: GHSA-9vp3-7qwq-83r9
Finding: F100
Auto approve: 1