[GHSA-jr5f-v2jv-69x6] axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL #5356
Conversation
|
Hi there @jasonsaayman! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository. This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory |
github-actions
bot
changed the base branch from
main
to
mhassan1/advisory-improvement-5356
| @@ -11,7 +11,7 @@ | |||
| "severity": [ | |||
| { | |||
| "type": "CVSS_V4", | |||
| "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P" | |||
There was a problem hiding this comment.
I didn't intend to remove the E metric, but the advisory improvement screen forced me to remove it, and I don't see a way to put it back.
There was a problem hiding this comment.
I've opened an issue about this limitation in the advisory improvement screen: #5357.
|
If there is an incomplete fix, then a separate advisory and CVE ID may be issued. I would like @jasonsaayman's thought on how to handle this. |
Updates
Comments
Version 1.8.2 contained an incomplete fix (it only included the
httpadapter); version 1.8.3 contains the fix for thexhrandfetchadapters