[GHSA-jr5f-v2jv-69x6] axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL

[mhassan1]

Updates

• Affected products
• CVSS v4
• References

Comments
Version 1.8.2 contained an incomplete fix (it only included the http adapter); version 1.8.3 contains the fix for the xhr and fetch adapters

[github]

Hi there @jasonsaayman! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[mhassan1]

I didn't intend to remove the E metric, but the advisory improvement screen forced me to remove it, and I don't see a way to put it back.

[mhassan1]

I've opened an issue about this limitation in the advisory improvement screen: #5357.

[JonathanLEvans]

If there is an incomplete fix, then a separate advisory and CVE ID may be issued. I would like @jasonsaayman's thought on how to handle this.

[jasonsaayman]

@JonathanLEvans I don't know what the standard practice is when it comes to a incomplete fix, however I think it may be better to handle it as a separate CVE.