CVE-2022-0122: Open Redirect in digitalbazaar/forge
Published Jan 6, 2022
·Updated
forge is vulnerable to URL Redirection to Untrusted Site
Other sources
parseUrl functionality in node-forge mishandles certain uses of backslash such as https:/\/\/\ and interprets the URI as a relative path.
Affected Software
2 affected componentsFixes available
npm/node-forge<1.0.0
1.0.0
digitalbazaar Forge Node.js<1.0.0
Remediation
Event History
Jan 6, 2022
CVE Published
via MITRE·05:00 AM
Data Sourced
via MITRE·05:00 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:15 AM
RemedyDescriptionSeverityWeaknessAffected Software
Jan 21, 2022
Advisory Published
11:36 PM
Frequently Asked Questions
1
What is the vulnerability ID for the parseUrl functionality in node-forge?
The vulnerability ID for the parseUrl functionality in node-forge is CVE-2022-0122.
2
What is the severity of CVE-2022-0122?
The severity of CVE-2022-0122 is medium (6.1).
3
Which software is affected by CVE-2022-0122?
The node-forge package with version up to but not including 1.0.0 is affected by CVE-2022-0122.
4
How does the parseUrl functionality in node-forge mishandle backslashes?
The parseUrl functionality in node-forge mishandles certain uses of backslashes, such as `https:/\/\/\`, and interprets the URI as a relative path.
5
Is there a fix available for CVE-2022-0122?
Yes, the remedy for CVE-2022-0122 is to upgrade to version 1.0.0 or later of the node-forge package.