UBUNTU-CVE-2023-26159
Advisory lineage Upstream: 1 Downstream: 1
Upstream
Downstream
Published: 02 Jan 2024, 05:15
Last modified:29 Apr 2026, 10:24
Vulnerability Summary
Overall Risk (default)
low
24/100 CVSS Score
6.1 MEDIUM
3.1 (osv_ubuntu)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
02 Jan 2024, 05:15
Published
Vulnerability first disclosed
29 Apr 2026, 10:24
Last Modified
Vulnerability information updated
Description
Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.
CVSS Metrics
- v3.1•MEDIUM•Score: 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Systems
- ubuntu•node-follow-redirects
all | all | all | all | all | all | all | < 1.2.4-1ubuntu0.18.04.1~esm1 | < 1.2.4-1ubuntu0.20.04.1~esm1 | < 1.14.9+~1.14.1-1ubuntu0.1~esm1