p PatchFirst

CVE-2020-28360

CVE-2020-28360

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Insufficient RegEx in private-ip npm package v1.0.5 and below insufficiently filters reserved IP ranges resulting in indeterminate SSRF. An attacker can perform a large range of requests to ARIN reserved IP ranges, resulting in an indeterminable number of critical attack vectors, allowing remote attackers to request server-side resources or potentially execute arbitrary code through various SSRF techniques.

CVSS 9.8 · Critical · EPSS 3.1% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • private-ip npm

    Affected ranges
    • SEMVER: < 2.0.0

    Update to 2.0.0

Original sources

Check your server →