High severityNVD Advisory· Published Aug 9, 2024· Updated Aug 15, 2024
CVE-2024-39338
CVE-2024-39338
Description
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
axiosnpm | >= 1.3.2, < 1.7.4 | 1.7.4 |
Affected products
63- osv-coords62 versionspkg:apk/chainguard/airflow-2pkg:apk/chainguard/airflow-2-compatpkg:apk/chainguard/airflow-2-iamguarded-compatpkg:apk/chainguard/argo-workflow-clipkg:apk/chainguard/argo-workflow-controllerpkg:apk/chainguard/argo-workflow-controller-compatpkg:apk/chainguard/argo-workflow-executorpkg:apk/chainguard/argo-workflow-executor-compatpkg:apk/chainguard/argo-workflowspkg:apk/chainguard/argo-workflows-known-hostspkg:apk/chainguard/argo-workflows-uipkg:apk/chainguard/jitsucom-jitsupkg:apk/chainguard/jitsucom-jitsu-consolepkg:apk/chainguard/jitsucom-jitsu-rotorpkg:apk/chainguard/kibana-7pkg:apk/chainguard/kibana-7-bitnamipkg:apk/chainguard/kibana-8pkg:apk/chainguard/kibana-8-bitnamipkg:apk/chainguard/kibana-8-iamguardedpkg:apk/chainguard/kubeflow-centraldashboardpkg:apk/chainguard/kubeflow-pipelinespkg:apk/chainguard/kubeflow-pipelines-apiserverpkg:apk/chainguard/kubeflow-pipelines-cache-deployerpkg:apk/chainguard/kubeflow-pipelines-cache-deployer-compatpkg:apk/chainguard/kubeflow-pipelines-cache_serverpkg:apk/chainguard/kubeflow-pipelines-frontendpkg:apk/chainguard/kubeflow-pipelines-metadata-envoy-configpkg:apk/chainguard/kubeflow-pipelines-metadata-writerpkg:apk/chainguard/kubeflow-pipelines-metadata-writer-compatpkg:apk/chainguard/kubeflow-pipelines-persistence_agentpkg:apk/chainguard/kubeflow-pipelines-scheduledworkflowpkg:apk/chainguard/kubeflow-pipelines-viewer-crd-controllerpkg:apk/chainguard/lernapkg:apk/wolfi/argo-workflow-clipkg:apk/wolfi/argo-workflow-controllerpkg:apk/wolfi/argo-workflow-controller-compatpkg:apk/wolfi/argo-workflow-executorpkg:apk/wolfi/argo-workflow-executor-compatpkg:apk/wolfi/argo-workflowspkg:apk/wolfi/argo-workflows-known-hostspkg:apk/wolfi/argo-workflows-uipkg:apk/wolfi/jitsucom-jitsupkg:apk/wolfi/jitsucom-jitsu-consolepkg:apk/wolfi/jitsucom-jitsu-rotorpkg:apk/wolfi/kubeflow-centraldashboardpkg:apk/wolfi/kubeflow-pipelinespkg:apk/wolfi/kubeflow-pipelines-apiserverpkg:apk/wolfi/kubeflow-pipelines-cache-deployerpkg:apk/wolfi/kubeflow-pipelines-cache-deployer-compatpkg:apk/wolfi/kubeflow-pipelines-cache_serverpkg:apk/wolfi/kubeflow-pipelines-frontendpkg:apk/wolfi/kubeflow-pipelines-metadata-envoy-configpkg:apk/wolfi/kubeflow-pipelines-metadata-writerpkg:apk/wolfi/kubeflow-pipelines-metadata-writer-compatpkg:apk/wolfi/kubeflow-pipelines-persistence_agentpkg:apk/wolfi/kubeflow-pipelines-scheduledworkflowpkg:apk/wolfi/kubeflow-pipelines-viewer-crd-controllerpkg:apk/wolfi/lernapkg:npm/axiospkg:rpm/opensuse/pgadmin4&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/velociraptor&distro=openSUSE%20Tumbleweedpkg:rpm/suse/pgadmin4&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Python%203%2015%20SP6
< 2.11.0-r15+ 61 more
- (no CPE)range: < 2.11.0-r15
- (no CPE)range: < 2.11.0-r15
- (no CPE)range: < 2.11.0-r15
- (no CPE)range: < 3.6.5-r2
- (no CPE)range: < 3.6.5-r2
- (no CPE)range: < 3.6.5-r2
- (no CPE)range: < 3.6.5-r2
- (no CPE)range: < 3.6.5-r2
- (no CPE)range: < 3.6.5-r2
- (no CPE)range: < 3.6.5-r2
- (no CPE)range: < 3.6.5-r2
- (no CPE)range: < 2.8.0-r1
- (no CPE)range: < 2.8.0-r1
- (no CPE)range: < 2.8.0-r1
- (no CPE)range: < 7.17.24-r0
- (no CPE)range: < 7.17.24-r0
- (no CPE)range: < 8.17.3-r2
- (no CPE)range: < 8.17.3-r2
- (no CPE)range: < 8.17.3-r2
- (no CPE)range: < 1.9.0-r1
- (no CPE)range: < 2.2.0-r10
- (no CPE)range: < 2.2.0-r10
- (no CPE)range: < 2.2.0-r10
- (no CPE)range: < 2.2.0-r10
- (no CPE)range: < 2.2.0-r10
- (no CPE)range: < 2.2.0-r10
- (no CPE)range: < 2.2.0-r10
- (no CPE)range: < 2.2.0-r10
- (no CPE)range: < 2.2.0-r10
- (no CPE)range: < 2.2.0-r10
- (no CPE)range: < 2.2.0-r10
- (no CPE)range: < 2.2.0-r10
- (no CPE)range: < 8.1.8-r1
- (no CPE)range: < 3.6.5-r2
- (no CPE)range: < 3.6.5-r2
- (no CPE)range: < 3.6.5-r2
- (no CPE)range: < 3.6.5-r2
- (no CPE)range: < 3.6.5-r2
- (no CPE)range: < 3.6.5-r2
- (no CPE)range: < 3.6.5-r2
- (no CPE)range: < 3.6.5-r2
- (no CPE)range: < 2.8.0-r1
- (no CPE)range: < 2.8.0-r1
- (no CPE)range: < 2.8.0-r1
- (no CPE)range: < 1.9.0-r1
- (no CPE)range: < 2.2.0-r10
- (no CPE)range: < 2.2.0-r10
- (no CPE)range: < 2.2.0-r10
- (no CPE)range: < 2.2.0-r10
- (no CPE)range: < 2.2.0-r10
- (no CPE)range: < 2.2.0-r10
- (no CPE)range: < 2.2.0-r10
- (no CPE)range: < 2.2.0-r10
- (no CPE)range: < 2.2.0-r10
- (no CPE)range: < 2.2.0-r10
- (no CPE)range: < 2.2.0-r10
- (no CPE)range: < 2.2.0-r10
- (no CPE)range: < 8.1.8-r1
- (no CPE)range: >= 1.3.2, < 1.7.4
- (no CPE)range: < 8.5-150600.3.6.1
- (no CPE)range: < 0.7.0.4.git97.675e45f9-12.1
- (no CPE)range: < 8.5-150600.3.6.1
Patches
Vulnerability mechanics
References
9- github.com/advisories/GHSA-8hc4-vh64-cxmjghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-39338ghsaADVISORY
- github.com/axios/axios/commit/6b6b605eaf73852fb2dae033f1e786155959de3aghsaWEB
- github.com/axios/axios/issues/6463ghsaWEB
- github.com/axios/axios/pull/6539ghsaWEB
- github.com/axios/axios/pull/6543ghsaWEB
- github.com/axios/axios/releasesghsaWEB
- github.com/axios/axios/releases/tag/v1.7.4ghsaWEB
- jeffhacks.com/advisories/2024/06/24/CVE-2024-39338.htmlghsaWEB
News mentions
0No linked articles in our index yet.