Vulnerabilites related to medialize - medialize/URI.js
cve-2021-3647
Vulnerability from cvelistv5
Published
2021-07-16 10:11
Modified
2024-08-03 17:01
Severity ?
5.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Summary
URI.js is vulnerable to URL Redirection to Untrusted Site
References
https://huntr.dev/bounties/1625558772840-medialize/URI.jsx_refsource_CONFIRM
https://github.com/medialize/URI.js/commit/ac43ca8f80c042f0256fb551ea5203863dec4481x_refsource_MISC
Impacted products
Vendor Product Version
medialize medialize/URI.js Version: unspecified   <
Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T17:01:08.296Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://huntr.dev/bounties/1625558772840-medialize/URI.js",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/medialize/URI.js/commit/ac43ca8f80c042f0256fb551ea5203863dec4481",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "medialize/URI.js",
               vendor: "medialize",
               versions: [
                  {
                     lessThanOrEqual: "1.19.6",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "URI.js is vulnerable to URL Redirection to Untrusted Site",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "LOW",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-601",
                     description: "CWE-601 URL Redirection to Untrusted Site",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-07-16T10:11:17",
            orgId: "c09c270a-b464-47c1-9133-acb35b22c19a",
            shortName: "@huntrdev",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://huntr.dev/bounties/1625558772840-medialize/URI.js",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/medialize/URI.js/commit/ac43ca8f80c042f0256fb551ea5203863dec4481",
            },
         ],
         source: {
            advisory: "1625558772840-medialize/URI.js",
            discovery: "EXTERNAL",
         },
         title: "Open Redirect in medialize/URI.js",
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security@huntr.dev",
               ID: "CVE-2021-3647",
               STATE: "PUBLIC",
               TITLE: "Open Redirect in medialize/URI.js",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "medialize/URI.js",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<=",
                                          version_value: "1.19.6",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "medialize",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "URI.js is vulnerable to URL Redirection to Untrusted Site",
                  },
               ],
            },
            impact: {
               cvss: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "LOW",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
                  version: "3.0",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-601 URL Redirection to Untrusted Site",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://huntr.dev/bounties/1625558772840-medialize/URI.js",
                     refsource: "CONFIRM",
                     url: "https://huntr.dev/bounties/1625558772840-medialize/URI.js",
                  },
                  {
                     name: "https://github.com/medialize/URI.js/commit/ac43ca8f80c042f0256fb551ea5203863dec4481",
                     refsource: "MISC",
                     url: "https://github.com/medialize/URI.js/commit/ac43ca8f80c042f0256fb551ea5203863dec4481",
                  },
               ],
            },
            source: {
               advisory: "1625558772840-medialize/URI.js",
               discovery: "EXTERNAL",
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "c09c270a-b464-47c1-9133-acb35b22c19a",
      assignerShortName: "@huntrdev",
      cveId: "CVE-2021-3647",
      datePublished: "2021-07-16T10:11:17",
      dateReserved: "2021-07-14T00:00:00",
      dateUpdated: "2024-08-03T17:01:08.296Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-1233
Vulnerability from cvelistv5
Published
2022-04-04 19:30
Modified
2024-08-02 23:55
Severity ?
6.5 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Summary
URL Confusion When Scheme Not Supplied in GitHub repository medialize/uri.js prior to 1.19.11.
References
https://huntr.dev/bounties/228d5548-1109-49f8-8aee-91038e88371cx_refsource_CONFIRM
https://github.com/medialize/uri.js/commit/88805fd3da03bd7a5e60947adb49d182011f1277x_refsource_MISC
Impacted products
Vendor Product Version
medialize medialize/uri.js Version: unspecified   < 1.19.11
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T23:55:24.574Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://huntr.dev/bounties/228d5548-1109-49f8-8aee-91038e88371c",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/medialize/uri.js/commit/88805fd3da03bd7a5e60947adb49d182011f1277",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "medialize/uri.js",
               vendor: "medialize",
               versions: [
                  {
                     lessThan: "1.19.11",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "URL Confusion When Scheme Not Supplied in GitHub repository medialize/uri.js prior to 1.19.11.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "LOW",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-115",
                     description: "CWE-115 Misinterpretation of Input",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-04-04T19:30:15",
            orgId: "c09c270a-b464-47c1-9133-acb35b22c19a",
            shortName: "@huntrdev",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://huntr.dev/bounties/228d5548-1109-49f8-8aee-91038e88371c",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/medialize/uri.js/commit/88805fd3da03bd7a5e60947adb49d182011f1277",
            },
         ],
         source: {
            advisory: "228d5548-1109-49f8-8aee-91038e88371c",
            discovery: "EXTERNAL",
         },
         title: "URL Confusion When Scheme Not Supplied in medialize/uri.js",
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security@huntr.dev",
               ID: "CVE-2022-1233",
               STATE: "PUBLIC",
               TITLE: "URL Confusion When Scheme Not Supplied in medialize/uri.js",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "medialize/uri.js",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "1.19.11",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "medialize",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "URL Confusion When Scheme Not Supplied in GitHub repository medialize/uri.js prior to 1.19.11.",
                  },
               ],
            },
            impact: {
               cvss: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "LOW",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
                  version: "3.0",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-115 Misinterpretation of Input",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://huntr.dev/bounties/228d5548-1109-49f8-8aee-91038e88371c",
                     refsource: "CONFIRM",
                     url: "https://huntr.dev/bounties/228d5548-1109-49f8-8aee-91038e88371c",
                  },
                  {
                     name: "https://github.com/medialize/uri.js/commit/88805fd3da03bd7a5e60947adb49d182011f1277",
                     refsource: "MISC",
                     url: "https://github.com/medialize/uri.js/commit/88805fd3da03bd7a5e60947adb49d182011f1277",
                  },
               ],
            },
            source: {
               advisory: "228d5548-1109-49f8-8aee-91038e88371c",
               discovery: "EXTERNAL",
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "c09c270a-b464-47c1-9133-acb35b22c19a",
      assignerShortName: "@huntrdev",
      cveId: "CVE-2022-1233",
      datePublished: "2022-04-04T19:30:15",
      dateReserved: "2022-04-04T00:00:00",
      dateUpdated: "2024-08-02T23:55:24.574Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-0868
Vulnerability from cvelistv5
Published
2022-03-06 15:20
Modified
2024-08-02 23:40
Severity ?
8.0 (High) - CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Summary
Open Redirect in GitHub repository medialize/uri.js prior to 1.19.10.
References
https://huntr.dev/bounties/5f4db013-64bd-4a6b-9dad-870c296b0b02x_refsource_CONFIRM
https://github.com/medialize/uri.js/commit/a8166fe02f3af6dc1b2b888dcbb807155aad9509x_refsource_MISC
Impacted products
Vendor Product Version
medialize medialize/uri.js Version: unspecified   < 1.19.10
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T23:40:04.559Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://huntr.dev/bounties/5f4db013-64bd-4a6b-9dad-870c296b0b02",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/medialize/uri.js/commit/a8166fe02f3af6dc1b2b888dcbb807155aad9509",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "medialize/uri.js",
               vendor: "medialize",
               versions: [
                  {
                     lessThan: "1.19.10",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Open Redirect in GitHub repository medialize/uri.js prior to 1.19.10.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "HIGH",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-601",
                     description: "CWE-601 URL Redirection to Untrusted Site",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-03-06T15:20:09",
            orgId: "c09c270a-b464-47c1-9133-acb35b22c19a",
            shortName: "@huntrdev",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://huntr.dev/bounties/5f4db013-64bd-4a6b-9dad-870c296b0b02",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/medialize/uri.js/commit/a8166fe02f3af6dc1b2b888dcbb807155aad9509",
            },
         ],
         source: {
            advisory: "5f4db013-64bd-4a6b-9dad-870c296b0b02",
            discovery: "EXTERNAL",
         },
         title: "Open Redirect in medialize/uri.js",
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security@huntr.dev",
               ID: "CVE-2022-0868",
               STATE: "PUBLIC",
               TITLE: "Open Redirect in medialize/uri.js",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "medialize/uri.js",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "1.19.10",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "medialize",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Open Redirect in GitHub repository medialize/uri.js prior to 1.19.10.",
                  },
               ],
            },
            impact: {
               cvss: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "HIGH",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-601 URL Redirection to Untrusted Site",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://huntr.dev/bounties/5f4db013-64bd-4a6b-9dad-870c296b0b02",
                     refsource: "CONFIRM",
                     url: "https://huntr.dev/bounties/5f4db013-64bd-4a6b-9dad-870c296b0b02",
                  },
                  {
                     name: "https://github.com/medialize/uri.js/commit/a8166fe02f3af6dc1b2b888dcbb807155aad9509",
                     refsource: "MISC",
                     url: "https://github.com/medialize/uri.js/commit/a8166fe02f3af6dc1b2b888dcbb807155aad9509",
                  },
               ],
            },
            source: {
               advisory: "5f4db013-64bd-4a6b-9dad-870c296b0b02",
               discovery: "EXTERNAL",
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "c09c270a-b464-47c1-9133-acb35b22c19a",
      assignerShortName: "@huntrdev",
      cveId: "CVE-2022-0868",
      datePublished: "2022-03-06T15:20:09",
      dateReserved: "2022-03-05T00:00:00",
      dateUpdated: "2024-08-02T23:40:04.559Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-1243
Vulnerability from cvelistv5
Published
2022-04-05 15:05
Modified
2024-08-02 23:55
Severity ?
7.2 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Summary
CRHTLF can lead to invalid protocol extraction potentially leading to XSS in GitHub repository medialize/uri.js prior to 1.19.11.
References
https://huntr.dev/bounties/8c5afc47-1553-4eba-a98e-024e4cc3dfb7x_refsource_CONFIRM
https://github.com/medialize/uri.js/commit/b0c9796aa1a95a85f40924fb18b1e5da3dc8ffaex_refsource_MISC
Impacted products
Vendor Product Version
medialize medialize/uri.js Version: unspecified   < 1.19.11
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T23:55:24.671Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://huntr.dev/bounties/8c5afc47-1553-4eba-a98e-024e4cc3dfb7",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/medialize/uri.js/commit/b0c9796aa1a95a85f40924fb18b1e5da3dc8ffae",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "medialize/uri.js",
               vendor: "medialize",
               versions: [
                  {
                     lessThan: "1.19.11",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "CRHTLF can lead to invalid protocol extraction potentially leading to XSS in GitHub repository medialize/uri.js prior to 1.19.11.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.2,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "LOW",
                  integrityImpact: "LOW",
                  privilegesRequired: "NONE",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-20",
                     description: "CWE-20 Improper Input Validation",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-04-05T15:05:18",
            orgId: "c09c270a-b464-47c1-9133-acb35b22c19a",
            shortName: "@huntrdev",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://huntr.dev/bounties/8c5afc47-1553-4eba-a98e-024e4cc3dfb7",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/medialize/uri.js/commit/b0c9796aa1a95a85f40924fb18b1e5da3dc8ffae",
            },
         ],
         source: {
            advisory: "8c5afc47-1553-4eba-a98e-024e4cc3dfb7",
            discovery: "EXTERNAL",
         },
         title: "CRHTLF can lead to invalid protocol extraction potentially leading to XSS in medialize/uri.js",
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security@huntr.dev",
               ID: "CVE-2022-1243",
               STATE: "PUBLIC",
               TITLE: "CRHTLF can lead to invalid protocol extraction potentially leading to XSS in medialize/uri.js",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "medialize/uri.js",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "1.19.11",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "medialize",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "CRHTLF can lead to invalid protocol extraction potentially leading to XSS in GitHub repository medialize/uri.js prior to 1.19.11.",
                  },
               ],
            },
            impact: {
               cvss: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.2,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "LOW",
                  integrityImpact: "LOW",
                  privilegesRequired: "NONE",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
                  version: "3.0",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-20 Improper Input Validation",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://huntr.dev/bounties/8c5afc47-1553-4eba-a98e-024e4cc3dfb7",
                     refsource: "CONFIRM",
                     url: "https://huntr.dev/bounties/8c5afc47-1553-4eba-a98e-024e4cc3dfb7",
                  },
                  {
                     name: "https://github.com/medialize/uri.js/commit/b0c9796aa1a95a85f40924fb18b1e5da3dc8ffae",
                     refsource: "MISC",
                     url: "https://github.com/medialize/uri.js/commit/b0c9796aa1a95a85f40924fb18b1e5da3dc8ffae",
                  },
               ],
            },
            source: {
               advisory: "8c5afc47-1553-4eba-a98e-024e4cc3dfb7",
               discovery: "EXTERNAL",
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "c09c270a-b464-47c1-9133-acb35b22c19a",
      assignerShortName: "@huntrdev",
      cveId: "CVE-2022-1243",
      datePublished: "2022-04-05T15:05:18",
      dateReserved: "2022-04-05T00:00:00",
      dateUpdated: "2024-08-02T23:55:24.671Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-0613
Vulnerability from cvelistv5
Published
2022-02-16 08:40
Modified
2024-08-02 23:32
Severity ?
5.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Summary
Authorization Bypass Through User-Controlled Key in NPM urijs prior to 1.19.8.
References
https://huntr.dev/bounties/f53d5c42-c108-40b8-917d-9dad51535083x_refsource_CONFIRM
https://github.com/medialize/uri.js/commit/6ea641cc8648b025ed5f30b090c2abd4d1a5249fx_refsource_MISC
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MXSSATHALUSXXD2KT6UFZAX7EG4GR332/vendor-advisory, x_refsource_FEDORA
Impacted products
Vendor Product Version
medialize medialize/uri.js Version: unspecified   < 1.19.8
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T23:32:46.462Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://huntr.dev/bounties/f53d5c42-c108-40b8-917d-9dad51535083",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/medialize/uri.js/commit/6ea641cc8648b025ed5f30b090c2abd4d1a5249f",
               },
               {
                  name: "FEDORA-2022-7cca5b6d38",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MXSSATHALUSXXD2KT6UFZAX7EG4GR332/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "medialize/uri.js",
               vendor: "medialize",
               versions: [
                  {
                     lessThan: "1.19.8",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Authorization Bypass Through User-Controlled Key in NPM urijs prior to 1.19.8.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "LOW",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-639",
                     description: "CWE-639 Authorization Bypass Through User-Controlled Key",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-02-25T18:06:11",
            orgId: "c09c270a-b464-47c1-9133-acb35b22c19a",
            shortName: "@huntrdev",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://huntr.dev/bounties/f53d5c42-c108-40b8-917d-9dad51535083",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/medialize/uri.js/commit/6ea641cc8648b025ed5f30b090c2abd4d1a5249f",
            },
            {
               name: "FEDORA-2022-7cca5b6d38",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MXSSATHALUSXXD2KT6UFZAX7EG4GR332/",
            },
         ],
         source: {
            advisory: "f53d5c42-c108-40b8-917d-9dad51535083",
            discovery: "EXTERNAL",
         },
         title: "Authorization Bypass Through User-Controlled Key in medialize/uri.js",
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security@huntr.dev",
               ID: "CVE-2022-0613",
               STATE: "PUBLIC",
               TITLE: "Authorization Bypass Through User-Controlled Key in medialize/uri.js",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "medialize/uri.js",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "1.19.8",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "medialize",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Authorization Bypass Through User-Controlled Key in NPM urijs prior to 1.19.8.",
                  },
               ],
            },
            impact: {
               cvss: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "LOW",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
                  version: "3.0",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-639 Authorization Bypass Through User-Controlled Key",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://huntr.dev/bounties/f53d5c42-c108-40b8-917d-9dad51535083",
                     refsource: "CONFIRM",
                     url: "https://huntr.dev/bounties/f53d5c42-c108-40b8-917d-9dad51535083",
                  },
                  {
                     name: "https://github.com/medialize/uri.js/commit/6ea641cc8648b025ed5f30b090c2abd4d1a5249f",
                     refsource: "MISC",
                     url: "https://github.com/medialize/uri.js/commit/6ea641cc8648b025ed5f30b090c2abd4d1a5249f",
                  },
                  {
                     name: "FEDORA-2022-7cca5b6d38",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MXSSATHALUSXXD2KT6UFZAX7EG4GR332/",
                  },
               ],
            },
            source: {
               advisory: "f53d5c42-c108-40b8-917d-9dad51535083",
               discovery: "EXTERNAL",
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "c09c270a-b464-47c1-9133-acb35b22c19a",
      assignerShortName: "@huntrdev",
      cveId: "CVE-2022-0613",
      datePublished: "2022-02-16T08:40:09",
      dateReserved: "2022-02-15T00:00:00",
      dateUpdated: "2024-08-02T23:32:46.462Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}