CVE-2020-8135: Server-Side Request Forgery (SSRF)

September 3, 2020 (updated October 4, 2021)

The uppy npm package is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacker to scan local or external network or otherwise interact with internal systems.

References

github.com/advisories/GHSA-mm7r-265w-jv6f
hackerone.com/reports/786956
nvd.nist.gov/vuln/detail/CVE-2020-8135
www.npmjs.com/advisories/1501

Detect and mitigate CVE-2020-8135 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →