Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS05dnAzLTdxd3EtODNyOc0zpw

Server-Side Request Forgery in FUXA

A Server-Side Request Forgery (SSRF) attack in FUXA 1.1.3 can be carried out leading to the obtaining of sensitive information from the server's internal environment and services, often potentially leading to the attacker executing commands on the server.

Permalink: https://github.com/advisories/GHSA-9vp3-7qwq-83r9
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05dnAzLTdxd3EtODNyOc0zpw
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 2 years ago
Updated: over 1 year ago


CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Identifiers: GHSA-9vp3-7qwq-83r9, CVE-2021-45851
References: Blast Radius: 1.0

Affected Packages

npm:@frangoteam/fuxa
Dependent packages: 1
Dependent repositories: 0
Downloads: 711 last month
Affected Version Ranges: <= 1.1.3
No known fixed version
All affected versions: 1.0.2, 1.0.4, 1.0.9, 1.0.10, 1.0.11, 1.1.1, 1.1.2, 1.1.3