PT-2022-13486 · Medialize · Uri.Js

Huydopp · Published 2022-03-06 · Updated 2022-03-11 · CVE-2022-0868

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions medialize/uri.js versions prior to 1.19.10 urijs versions prior to 1.19.10

Description The issue is an Open Redirect in the GitHub repository medialize/uri.js. This is the result of a bypass for the fix to a previous issue.

Recommendations For medialize/uri.js versions prior to 1.19.10, update to version 1.19.10 or later. For urijs versions prior to 1.19.10, update to version 1.19.10 or later.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2022-0868

GHSA-8H2F-7JC4-7M3M

Affected Products

Uri.Js

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0868.json · Exploit
• 🔥 https://huntr.dev/bounties/5f4db013-64bd-4a6b-9dad-870c296b0b02 · Exploit
• https://github.com/medialize/uri.js/commit/a8166fe02f3af6dc1b2b888dcbb807155aad9509 · Patch
• https://osv.dev/vulnerability/CVE-2022-0868 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8h2f-7jc4-7m3m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0868 · Security Note
• https://github.com/medialize/URI.js/releases/tag/v1.19.10 · Note
• https://github.com/medialize/uri.js · Note
• https://t.me/cibsecurity/38496 · Telegram Post
• https://t.me/cvenotify/27809 · Telegram Post