CVE-2024-39338
CVE-2024-39338
This page contains facts from public vulnerability sources. Check the original advisory before updating.
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.
CVSS 4.0 · Medium · EPSS 1.2% · Fix available
- Published
- Updated
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
node-axios Debian:13
- Affected ranges
- ECOSYSTEM: < 1.7.4+dfsg-1
Update to 1.7.4+dfsg-1
node-axios Debian:14
- Affected ranges
- ECOSYSTEM: < 1.7.4+dfsg-1
Update to 1.7.4+dfsg-1
axios npm
- Affected ranges
- SEMVER: ≥ 1.3.2, < 1.7.4
Update to 1.7.4
node-axios Ubuntu:Pro:20.04:LTS
- Versions
- 0.19.0+dfsg-2
- 0.19.0+dfsg-2ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-axios Ubuntu:Pro:22.04:LTS
- Versions
- 0.21.1+dfsg-1
- 0.23.0+dfsg-2
- 0.24.0+dfsg-1
- 0.25.0+dfsg-2
- 0.26.0+dfsg-1
- 0.26.0+dfsg-1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-axios Ubuntu:Pro:24.04:LTS
- Versions
- 1.2.1+dfsg-1
- 1.5.1+dfsg-1
- 1.6.2+dfsg-1
- 1.6.8+dfsg-2
- 1.6.8+dfsg-2ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-axios Ubuntu:25.10
- Versions
- 1.7.9+dfsg-1
- 1.8.4+dfsg-1
- 1.11.0+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-axios Ubuntu:26.10
- Versions
- 1.13.2+dfsg-1build1
- 1.16.0-1
- 1.18.0-1
- 1.19.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-axios Ubuntu:Pro:26.04:LTS
- Versions
- 1.11.0+dfsg-1
- 1.12.1+dfsg-1
- 1.13.2+dfsg-1build1
- 1.13.2+dfsg-1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published