Vulnerability

[github-actions]

{
"actions": [
{
"action": "update",
"resolves": [
{
"id": 1594,
"path": "axios",
"dev": false,
"optional": false,
"bundled": false
}
],
"module": "axios",
"target": "0.21.1",
"depth": 1
}
],
"advisories": {
"1594": {
"findings": [
{
"version": "0.21.0",
"paths": [
"axios"
]
}
],
"id": 1594,
"created": "2021-01-04T21:04:59.346Z",
"updated": "2021-01-04T21:05:54.214Z",
"deleted": null,
"title": "Server-Side Request Forgery",
"found_by": {
"link": "",
"name": "Anonymous",
"email": ""
},
"reported_by": {
"link": "",
"name": "Anonymous",
"email": ""
},
"module_name": "axios",
"cves": [
"CVE-2020-28168"
],
"vulnerable_versions": "<0.21.1",
"patched_versions": ">=0.21.1",
"overview": "The axios NPM package before 0.21.1 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address.",
"recommendation": "Upgrade to 0.21.1 or later.",
"references": "- Github Issue\n- Fix commit\n- GitHub Advisory\n- Snyk Report",
"access": "public",
"severity": "high",
"cwe": "CWE-918",
"metadata": {
"module_type": "",
"exploitability": 5,
"affected_components": ""
},
"url": "https://npmjs.com/advisories/1594"
}
},
"muted": [],
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 0,
"high": 1,
"critical": 0
},
"dependencies": 2,
"devDependencies": 0,
"optionalDependencies": 0,
"totalDependencies": 2
},
"runId": "4903792b-b6f8-436e-aae2-a85793612e63"
}