PT-2022-12970 · Uppy · Uppy

Mifiauthored · Published 2022-01-04 · Updated 2022-01-08 · CVE-2022-0086

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions uppy (affected versions not specified)

Description The issue is related to Server-Side Request Forgery (SSRF), which allows an attacker to trick the server into making requests to unintended locations. This can be achieved via IPv4-mapped IPv6 addresses.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2022-0086

GHSA-X8RQ-RC7X-5FG5

Affected Products

Uppy

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0086.json · Exploit
• 🔥 https://huntr.dev/bounties/c1c03ef6-3f18-4976-a9ad-08c251279122 · Exploit
• https://github.com/transloadit/uppy/commit/fc137e30a2a3102eb191141f280d5de20dacdf8f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-0086 · Security Note
• https://osv.dev/vulnerability/GHSA-x8rq-rc7x-5fg5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-0086 · Vendor Advisory
• https://github.com/transloadit/uppy · Note
• https://github.com/transloadit/uppy/releases/tag/uppy%402.3.3 · Note
• https://github.com/transloadit/uppy/pull/3403 · Note
• https://t.me/cibsecurity/34946 · Telegram Post
• https://t.me/cvenotify/25141 · Telegram Post