10
CVSSv3

CVE-2018-3774

Published: 12/08/2018 Updated: 09/10/2019
CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10
CVSS v3 Base Score: 10 | Impact Score: 6 | Exploitability Score: 3.9
VMScore: 668
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Summary

Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

url-parse project url-parse

Vendor Advisories

Debian Bug report logs - #906058 node-url-parse: CVE-2018-3774 Package: src:node-url-parse; Maintainer for src:node-url-parse is Debian Javascript Maintainers &lt;pkg-javascript-devel@listsaliothdebianorg&gt;; Reported by: Salvatore Bonaccorso &lt;carnil@debianorg&gt; Date: Mon, 13 Aug 2018 18:45:02 UTC Severity: important T ...

Github Repositories

Cx SCA PoCs This repo hosts all Exploits/PoCs made by Checkmarx SCA's AppSec team The purpose is to prove that the data of the related vulnerabilities is correct, and to show that they are indeed exploitable Directory layout example ├── CVE-2018-3774 # Directory of PoC for some CVE/vulnerability │ ├── exploitjs # The file of the expl