Description
nuxt-api-party allows developers to proxy requests to an API without exposing credentials to the client. A previous vulnerability allowed an attacker to change the baseURL of the request, potentially leading to credentials being leaked or SSRF.
Recommendation
Update the nuxt-api-party package to the latest compatible version. Followings are version details:
- Affected version(s): < 0.22.0
- Patched version(s): 0.22.0
References
Could your website be exposed too?
SmartScanner can check your website for SSRF & Credentials Leak and gives you actionable findings to investigate.
Start a free scanRelated Issues
- google-translate-api-browser Server-Side Request Forgery (SSRF) Vulnerability - CVE-2023-48711
- Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry - CVE-2026-59891
- DOS by abusing `fetchOptions.retry`. - CVE-2023-49800
- matrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged rooms - CVE-2023-38700
You might also like:
See something that needs correcting? Let us knowUpdated December 12, 2023