CVE-2024-39338

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.

Score

CVSS 3.1 7.5 High

Status

Analyzed - cve@mitre.org

Published

2024-08-12

Last modified

2024-08-15

Weaknesses

CWE-918

Affected products

• Axios (Axios)

References

• https://github.com/axios/axios/releases
• https://jeffhacks.com/advisories/2024/06/24/CVE-2024-39338.html