by Kastro
Paper/Archive/CVE-2023-42282

CVE-2023-42282

mitre — The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globall…

EPSS 2%public exploitCVSS 9.8
critical.is priorityof 100
55
CVSS 9.8 (ADP, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 76.0.760 × 2015.2Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refcosmosofcyberspace.github.io/npm_ip_cve/npm_ip_cve.htmlrefgithub.com/indutny/node-ip/commit/6a3ada9b471b09d5f0f5be264911ab564bf67894refhuntr.com/bounties/bfc3b23f-ddc0-4ee7-afab-223b07115ed3refsecurity.netapp.com/advisory/ntap-20240315-0008refbleepingcomputer.com/news/security/dev-rejects-cve-severity-makes-his-github-repo-read-only