Fluid Attacks Database

Description

Authorization Bypass Through User-Controlled Key in url-parse url-parse prior to version 1.5.8 is vulnerable to Authorization Bypass Through User-Controlled Key.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
npm	url-parse	>=0 <1.5.8	1.5.8
debian 14	node-url-parse	>=0 <1.5.9+~1.4.8-1	1.5.9+~1.4.8-1
debian 11	node-url-parse	=1.5.3-1 \|\| >=0 <1.5.3-1+deb11u1	1.5.3-1+deb11u1
debian 12	node-url-parse	>=0 <1.5.9+~1.4.8-1	1.5.9+~1.4.8-1
debian 13	node-url-parse	>=0 <1.5.9+~1.4.8-1	1.5.9+~1.4.8-1

Aliases

1. CVE-2022-06862. NVD-2022-06863. OSV-2022-06864. OSV-DEBIAN-2022-06865. GCVE-2022-06866. lists.debian.org7. SECURITY-TRACKER-CVE-2022-0686

References

1. https://github.com/unshiftio/url-parse/commit/d5c64791ef496ca5459ae7f2176a31ea53b127e52. https://huntr.dev/bounties/55fd06cd-9054-4d80-83be-eb5a454be78c3. https://security.netapp.com/advisory/ntap-20220325-0006

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.