CVE-2022-33987: Medium severity got project got vulnerability
A flaw was found in the got package for node.js. Requested URLs are not verified and allow open redirection to a local UNIX socket.
Other sources
Node.js got module could allow a remote attacker to bypass security restrictions, caused by an unspecified. By sending a specially-crafted request, an attacker could exploit this vulnerability to perform a redirect to a UNIX socket.
— IBM
The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-33987?
CVE-2022-33987 has been classified with a severity that indicates significant security risks associated with open redirection vulnerabilities.
How do I fix CVE-2022-33987?
To fix CVE-2022-33987, update the `got` package to version 12.1.0 or later.
What software is affected by CVE-2022-33987?
CVE-2022-33987 affects the `got` package versions up to 11.8.5 and various node.js related packages.
What type of vulnerability is CVE-2022-33987?
CVE-2022-33987 is an open redirection vulnerability that could allow attackers to bypass security restrictions.
Can CVE-2022-33987 allow unauthorized access?
Yes, CVE-2022-33987 can potentially allow an attacker to redirect requests to unauthorized local UNIX sockets.