<p>Upgrade <code>find-my-way</code> to version 2.2.5, 3.0.5 or higher.</p>

Web Cache Poisoning Affecting find-my-way package, versions <2.2.5 >=3.0.0 <3.0.5

Threat Intelligence

Proof of concept

0.11% (45^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-JS-FINDMYWAY-1038269
published 8 Nov 2020
disclosed 3 Nov 2020
credit yousteen, trygve_lie

Report a new vulnerability Found a mistake?

Introduced: 3 Nov 2020

CVE-2020-7764 Open this link in a new tab CWE-444 Open this link in a new tab First added by Snyk

How to fix?

Upgrade find-my-way to version 2.2.5, 3.0.5 or higher.

Overview

Affected versions of this package are vulnerable to Web Cache Poisoning. It accepts the Accept-Version header by default, and if versioned routes are not being used, this could lead to a denial of service. Accept-Version can be used as an unkeyed header in a cache poisoning attack.

References

CVSS Scores

version 3.1

Attack Vector (AV)

Network
Attack Complexity (AC)

High
Privileges Required (PR)

None
User Interaction (UI)

None

Scope (S)

Unchanged

Confidentiality (C)

None
Integrity (I)

None
Availability (A)

High