CVE-2022-0122: Open Redirect in digitalbazaar/forge
forge is vulnerable to URL Redirection to Untrusted Site
Other sources
parseUrl functionality in node-forge mishandles certain uses of backslash such as https:/\/\/\ and interprets the URI as a relative path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/node-forgeto a version that resolves this vulnerability.Fixed in 1.0.0
Event History
Frequently Asked Questions
What is the vulnerability ID for the parseUrl functionality in node-forge?
The vulnerability ID for the parseUrl functionality in node-forge is CVE-2022-0122.
What is the severity of CVE-2022-0122?
The severity of CVE-2022-0122 is medium (6.1).
Which software is affected by CVE-2022-0122?
The node-forge package with version up to but not including 1.0.0 is affected by CVE-2022-0122.
How does the parseUrl functionality in node-forge mishandle backslashes?
The parseUrl functionality in node-forge mishandles certain uses of backslashes, such as `https:/\/\/\`, and interprets the URI as a relative path.
Is there a fix available for CVE-2022-0122?
Yes, the remedy for CVE-2022-0122 is to upgrade to version 1.0.0 or later of the node-forge package.