First published: Thu Mar 16 2023(Updated: )
** UNSUPPORTED WHEN ASSIGNED ** The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Credit: cve@mitre.org cve@mitre.org cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
Request Project Request | <=2.88.1 | |
npm/@cypress/request | <=2.88.12 | 3.0.0 |
npm/request | <=2.88.2 | |
IBM Watson Knowledge Catalog on-prem | <=4.x |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2023-28155 is a vulnerability in the Node.js Request module that allows a bypass of server-side request forgery (SSRF) mitigations through a cross-protocol redirect.
CVE-2023-28155 affects Node.js through the Request package up to version 2.88.1 and @cypress/request up to version 2.88.12, allowing SSRF attacks.
CVE-2023-28155 has a severity rating of medium with a CVSS score of 6.1.
To fix CVE-2023-28155, upgrade the Request package to version 2.88.2 or higher, or upgrade @cypress/request to version 3.0.0 or higher.
Yes, IBM Watson Knowledge Catalog on-prem versions up to 4.x are affected by CVE-2023-28155.