UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwarded-Host, X-Forwarded-Proto and X-Forwarded-Prefix request headers, with no ch…
Info
Summary
UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwarded-Host, X-Forwarded-Proto and X-Forwarded-Prefix request headers, with no check on whether the sender was a trusted proxy, falling back to the client-supplied Host header. …
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://github.com/eclipse-openvsx/openvsx/pull/2196
- https://github.com/eclipse-openvsx/openvsx/security/advisories/GHSA-f55q-5m46-rmxc
- https://gitlab.eclipse.org/security/cve-assignment/-/work_items/75
Timeline
- nvd_ingest NVD