CVE-2018-3774: SSRF
A flaw was found in nodejs-url-parse. The wrong hostname can be returned, due to incorrect parsing, which can lead to a variety of vulnerabilities. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol.
Versions of url-parse before 1.4.3 returns the wrong hostname which could lead to Open Redirect, Server Side Request Forgery (SSRF), or Bypass Authentication Protocol vulnerabilities.
Recommendation
Update to version 1.4.3 or later.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-3774?
CVE-2018-3774 is a vulnerability in nodejs-url-parse that can return the wrong hostname due to incorrect parsing.
What is the severity of CVE-2018-3774?
The severity of CVE-2018-3774 is critical with a severity value of 10.
How does CVE-2018-3774 impact data confidentiality and integrity?
CVE-2018-3774 can potentially compromise data confidentiality and integrity.
How can CVE-2018-3774 be fixed?
To fix CVE-2018-3774, update the affected software to version 1.4.3.
Where can I find more information about CVE-2018-3774?
You can find more information about CVE-2018-3774 from the CVE website and the NVD website.