GHSA-jgrh-5m3h-9c5fMediumCVSS 5.9

Web Cache Poisoning in find-my-way

Published
November 9, 2020
Last Modified
January 9, 2023

🔗 CVE IDs covered (1)

CVE-2020-7764 →

📋 Description

This affects the package find-my-way before 2.2.5, from 3.0.0 and before 3.0.5. It accepts the Accept-Version' header by default, and if versioned routes are not being used, this could lead to a denial of service. Accept-Version can be used as an unkeyed header in a cache poisoning attack.

🎯 Affected products2

  • npm/find-my-way:< 2.2.5
  • npm/find-my-way:>= 3.0.0, < 3.0.5

🔗 References (5)