CVE-2022-25876

Server-side Request Forgery (SSRF)

Medium · published July 1, 2022

CVSS v3.1
6.2
EPSS
0%
Percentile
29.4
In the wild
Unconfirmed
What it is

The package link-preview-js before 2.1.16 are vulnerable to Server-side Request Forgery (SSRF) which allows attackers to send arbitrary requests to the local network and read the response. This is due to flawed DNS rebinding protection.

The record
Technical detail
CVSS v3.1
6.2 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P
CVSS v4.0
Not supplied
EPSS
0.00368 · 29.4th percentile
Published
2022-07-01T20:00Z
EPSS history
Timeline
  • 01 JUL 20:00Z
    Server-side Request Forgery (SSRF)
    cvelistv5