CVE-2021-27515: Input Validation
An input validation flaw exists in the node.js-url-parse, which results in the URL being incorrectly set to the document location protocol instead of the URL being passed as an argument. This flaw allows an attacker to bypass security checks on URLs. The highest threat from this vulnerability is to integrity. This is an incomplete fix for CVE-2020-8124.
Other sources
url-parse before 1.5.0 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2021-27515.
What is the severity of CVE-2021-27515?
The severity of CVE-2021-27515 is medium with a CVSS score of 5.3.
Which software is affected by CVE-2021-27515?
The url-parse package before version 1.5.0 is affected by CVE-2021-27515.
How does CVE-2021-27515 affect security?
CVE-2021-27515 allows an attacker to bypass security checks on URLs.
How can I fix CVE-2021-27515?
To fix CVE-2021-27515, upgrade to version 1.5.0 of the url-parse package.