Vulnerability Details CVE-2022-25876
The package link-preview-js before 2.1.16 are vulnerable to Server-side Request Forgery (SSRF) which allows attackers to send arbitrary requests to the local network and read the response. This is due to flawed DNS rebinding protection.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 22.9%
CVSS Severity
CVSS v3 Score 6.2
CVSS v2 Score 2.1
References
- https://github.com/ospfranco/link-preview-js/issues/115
- https://github.com/ospfranco/link-preview-js/pull/117
- https://snyk.io/vuln/SNYK-JS-LINKPREVIEWJS-2933520
- https://github.com/ospfranco/link-preview-js/issues/115
- https://github.com/ospfranco/link-preview-js/pull/117
- https://snyk.io/vuln/SNYK-JS-LINKPREVIEWJS-2933520
Products affected by CVE-2022-25876
-
cpe:2.3:a:link-preview-js_project:link-preview-js:-
-
cpe:2.3:a:link-preview-js_project:link-preview-js:1.4.3
-
cpe:2.3:a:link-preview-js_project:link-preview-js:1.4.4
-
cpe:2.3:a:link-preview-js_project:link-preview-js:1.5.0
-
cpe:2.3:a:link-preview-js_project:link-preview-js:1.6.0
-
cpe:2.3:a:link-preview-js_project:link-preview-js:2.0.0
-
cpe:2.3:a:link-preview-js_project:link-preview-js:2.0.1
-
cpe:2.3:a:link-preview-js_project:link-preview-js:2.0.2
-
cpe:2.3:a:link-preview-js_project:link-preview-js:2.0.3
-
cpe:2.3:a:link-preview-js_project:link-preview-js:2.0.4
-
cpe:2.3:a:link-preview-js_project:link-preview-js:2.0.5
-
cpe:2.3:a:link-preview-js_project:link-preview-js:2.1.0
-
cpe:2.3:a:link-preview-js_project:link-preview-js:2.1.1
-
cpe:2.3:a:link-preview-js_project:link-preview-js:2.1.10
-
cpe:2.3:a:link-preview-js_project:link-preview-js:2.1.11
-
cpe:2.3:a:link-preview-js_project:link-preview-js:2.1.12
-
cpe:2.3:a:link-preview-js_project:link-preview-js:2.1.13
-
cpe:2.3:a:link-preview-js_project:link-preview-js:2.1.14
-
cpe:2.3:a:link-preview-js_project:link-preview-js:2.1.15
-
cpe:2.3:a:link-preview-js_project:link-preview-js:2.1.2
-
cpe:2.3:a:link-preview-js_project:link-preview-js:2.1.3
-
cpe:2.3:a:link-preview-js_project:link-preview-js:2.1.4
-
cpe:2.3:a:link-preview-js_project:link-preview-js:2.1.5
-
cpe:2.3:a:link-preview-js_project:link-preview-js:2.1.6
-
cpe:2.3:a:link-preview-js_project:link-preview-js:2.1.7
-
cpe:2.3:a:link-preview-js_project:link-preview-js:2.1.8
-
cpe:2.3:a:link-preview-js_project:link-preview-js:2.1.9