Vulnerabilities (CVE)

Join the Common Vulnerabilities and Exposures (CVE) community and start to get notified about new vulnerabilities.

  1. Reconshell
  2. Vulnerabilities (CVE)
Filtered by vendor Fastify-reply-from Project Subscribe
Filtered by product Fastify-reply-from
Total 1 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2021-21321 1 Fastify-reply-from Project 1 Fastify-reply-from 2021-03-09 7.5 HIGH 10.0 CRITICAL
fastify-reply-from is an npm package which is a fastify plugin to forward the current http request to another server. In fastify-reply-from before version 4.0.2, by crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is "/pub/", a user expect that accessing "/priv" on the target service would not be possible. In affected versions, it is possible. This is fixed in version 4.0.2.