Insufficient RegEx in private-ip npm package v1.0.5 and below insufficiently filters reserved IP ranges resulting in indeterminate SSRF. An attacker can perform a large range of requests to ARIN reserved IP ranges, resulting in an indeterminable number of critical attack vectors, allowing remote attackers to request server-side resources or potentially execute arbitrary code through various SSRF techniques.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2020-11-23T20:33:13

Updated: 2024-08-04T16:33:59.002Z

Reserved: 2020-11-09T00:00:00

Link: CVE-2020-28360

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2020-11-23T21:15:12.423

Modified: 2024-11-21T05:22:39.477

Link: CVE-2020-28360

cve-icon Redhat

No data.