CVE-2024-28607

Low

The ip-utils package through 2.4.0 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as…

mitre·CWE-180·Published 2025-03-11

CVSS

2.9

EPSS

0.00

KEV

Exploits

cve.orgen

190 chars

The ip-utils package through 2.4.0 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via a falsy isPrivate return value.

NVDen

190 chars

The ip-utils package through 2.4.0 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via a falsy isPrivate return value.

El paquete ip-utils hasta la versión 2.4.0 para Node.js podría permitir SSRF porque algunas direcciones IP (como 0x7f.1) están categorizadas incorrectamente como enrutables globalmente a través de un valor de retorno isPrivate falso.

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
3.1	Primary	cve.org	2.9	—	—	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
3.1	Primary	cve.org	2.9	—	—	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
3.1	Secondary	NVD	2.9	1.4	1.4	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N