PT-2024-28456

CVE-2024-39338

Published

2024-08-09

Updated

2026-08-24

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions axios version 1.7.2

Description An issue exists where requests for path relative URLs are unexpectedly processed as protocol relative URLs, which allows Server-Side Request Forgery (SSRF). SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.

Recommendations Update axios to version 1.7.5.

Exploitability

Exploit

Fix

Impacts

Researchers

Jeff Thomas

Vendors

Affected products

Weakness enumeration

CWE-918: Server-Side Request Forgery (SSRF)

Related identifiers