{"id":"CVE-2022-0613","aliases":["EUVD-2022-1011","GHSA-gcv8-gh4r-25x6","RHBA-2022:1352","RHBA-2022:1386","UBUNTU-CVE-2022-0613"],"status":"published","title":"Authorization Bypass Through User-Controlled Key in medialize/uri.js","description":"Authorization Bypass Through User-Controlled Key in NPM urijs prior to 1.19.8.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01537,"percentile":0.7505,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-639"],"published":"2022-02-16T08:40:09Z","modified":"2026-10-28T02:31:02Z","fixes":[{"ecosystem":"npm","package":"urijs","fixed_in":["1.19.8"],"sources":["ghsa","osv"]},{"ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-aspnetcore-runtime-3.1","fixed_in":["0:3.1.24-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-aspnetcore-targeting-pack-3.1","fixed_in":["0:3.1.24-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-dotnet","fixed_in":["0:3.1.418-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-dotnet-apphost-pack-3.1","fixed_in":["0:3.1.24-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-dotnet-debuginfo","fixed_in":["0:3.1.418-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-dotnet-host","fixed_in":["0:3.1.24-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-dotnet-hostfxr-3.1","fixed_in":["0:3.1.24-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-dotnet-runtime-3.1","fixed_in":["0:3.1.24-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-dotnet-sdk-3.1","fixed_in":["0:3.1.418-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-dotnet-sdk-3.1-source-built-artifacts","fixed_in":["0:3.1.418-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-dotnet-targeting-pack-3.1","fixed_in":["0:3.1.24-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-dotnet-templates-3.1","fixed_in":["0:3.1.418-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-netstandard-targeting-pack-2.1","fixed_in":["0:3.1.418-1.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"aspnetcore-runtime-3.1","fixed_in":["0:3.1.24-1.el8_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"aspnetcore-targeting-pack-3.1","fixed_in":["0:3.1.24-1.el8_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-apphost-pack-3.1","fixed_in":["0:3.1.24-1.el8_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-apphost-pack-3.1-debuginfo","fixed_in":["0:3.1.24-1.el8_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-hostfxr-3.1","fixed_in":["0:3.1.24-1.el8_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-hostfxr-3.1-debuginfo","fixed_in":["0:3.1.24-1.el8_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-runtime-3.1","fixed_in":["0:3.1.24-1.el8_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-runtime-3.1-debuginfo","fixed_in":["0:3.1.24-1.el8_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-sdk-3.1","fixed_in":["0:3.1.418-1.el8_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-sdk-3.1-debuginfo","fixed_in":["0:3.1.418-1.el8_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-targeting-pack-3.1","fixed_in":["0:3.1.24-1.el8_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-templates-3.1","fixed_in":["0:3.1.418-1.el8_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet3.1","fixed_in":["0:3.1.418-1.el8_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet3.1-debuginfo","fixed_in":["0:3.1.418-1.el8_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet3.1-debugsource","fixed_in":["0:3.1.418-1.el8_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dotnet-apphost-pack-3.1-debuginfo","fixed_in":["0:3.1.24-1.el8_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dotnet-hostfxr-3.1-debuginfo","fixed_in":["0:3.1.24-1.el8_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dotnet-runtime-3.1-debuginfo","fixed_in":["0:3.1.24-1.el8_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dotnet-sdk-3.1-debuginfo","fixed_in":["0:3.1.418-1.el8_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dotnet-sdk-3.1-source-built-artifacts","fixed_in":["0:3.1.418-1.el8_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dotnet3.1-debuginfo","fixed_in":["0:3.1.418-1.el8_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dotnet3.1-debugsource","fixed_in":["0:3.1.418-1.el8_5"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"urijs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.8"}]}]},{"source":"osv","ecosystem":"npm","package":"urijs","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.19.8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-aspnetcore-runtime-3.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.24-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-aspnetcore-targeting-pack-3.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.24-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-dotnet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.418-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-dotnet-apphost-pack-3.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.24-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-dotnet-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.418-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-dotnet-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.24-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-dotnet-hostfxr-3.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.24-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-dotnet-runtime-3.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.24-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-dotnet-sdk-3.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.418-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-dotnet-sdk-3.1-source-built-artifacts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.418-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-dotnet-targeting-pack-3.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.24-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-dotnet-templates-3.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.418-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_dotnet:3.1::el7","package":"rh-dotnet31-netstandard-targeting-pack-2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.418-1.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"aspnetcore-runtime-3.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.24-1.el8_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"aspnetcore-targeting-pack-3.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.24-1.el8_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-apphost-pack-3.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.24-1.el8_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-apphost-pack-3.1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.24-1.el8_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-hostfxr-3.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.24-1.el8_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-hostfxr-3.1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.24-1.el8_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-runtime-3.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.24-1.el8_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-runtime-3.1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.24-1.el8_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-sdk-3.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.418-1.el8_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-sdk-3.1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.418-1.el8_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-targeting-pack-3.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.24-1.el8_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet-templates-3.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.418-1.el8_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet3.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.418-1.el8_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet3.1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.418-1.el8_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dotnet3.1-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.418-1.el8_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dotnet-apphost-pack-3.1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.24-1.el8_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dotnet-hostfxr-3.1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.24-1.el8_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dotnet-runtime-3.1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.24-1.el8_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dotnet-sdk-3.1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.418-1.el8_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dotnet-sdk-3.1-source-built-artifacts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.418-1.el8_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dotnet3.1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.418-1.el8_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"dotnet3.1-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.418-1.el8_5"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"pat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.0-2","0.12.0-1","0.12.1-1","0.12.1-1ubuntu0.1","0.12.1-1ubuntu0.1+esm1","0.12.1-1ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"pat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.15.0-1build1","0.15.1-1","0.15.1-1ubuntu0.1","0.15.1-1ubuntu0.2","0.15.1-1ubuntu0.2+esm1","0.15.1-1ubuntu0.3","0.15.1-1ubuntu0.3+esm1","0.15.1-1ubuntu0.3+esm2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"pat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.16.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"pat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.19.1-1","1.0.0-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"pat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.16.0-1","0.19.1-1","0.19.1-1ubuntu0.1~esm1"]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"medialize","product":"medialize/uri.js"},{"vendor":"uri.js_project","product":"uri.js"}],"references":[{"url":"https://huntr.dev/bounties/f53d5c42-c108-40b8-917d-9dad51535083","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","web","report"]},{"url":"https://github.com/medialize/uri.js/commit/6ea641cc8648b025ed5f30b090c2abd4d1a5249f","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MXSSATHALUSXXD2KT6UFZAX7EG4GR332/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0613","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MXSSATHALUSXXD2KT6UFZAX7EG4GR332/"},{"url":"https://github.com/advisories/GHSA-gcv8-gh4r-25x6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0613.json","tags":["advisory"]},{"url":"https://github.com/medialize/uri.js","tags":["package"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MXSSATHALUSXXD2KT6UFZAX7EG4GR332","tags":["web"]},{"url":"https://access.redhat.com/errata/RHBA-2022:1352","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhba-2022_1352.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-0613","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055496","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-0613","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHBA-2022:1386","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhba-2022_1386.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-0613","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-0613","title":"Authorization Bypass Through User-Controlled Key in medialize/uri.js","description":"Authorization Bypass Through User-Controlled Key in NPM urijs prior to 1.19.8.","status":"published","published":"2022-02-16T08:40:09Z","modified":"2024-08-02T23:32:46.462Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:34:42.028422Z"}],"euvd":[{"id":"EUVD-2022-1011","description":"Authorization Bypass Through User-Controlled Key in NPM urijs prior to 1.19.8.","status":"published","published":"2022-02-16T08:40:09Z","modified":"2024-08-02T23:32:46Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T03:26:04.946671Z"}],"ghsa":[{"id":"GHSA-gcv8-gh4r-25x6","title":"Authorization Bypass Through User-Controlled Key in urijs","description":"Attacker can use case-insensitive protocol schemes like HTTP, htTP, HTtp etc. in order to bypass the patch for CVE-2021-3647.","status":"published","published":"2022-02-17T00:00:35Z","modified":"2023-02-03T05:06:18Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:36:43.439065Z"}],"nvd":[{"id":"CVE-2022-0613","description":"Authorization Bypass Through User-Controlled Key in NPM urijs prior to 1.19.8.","status":"published","published":"2022-02-16T09:15:07.043Z","modified":"2026-06-17T04:20:56.24Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:07:12.155838Z"}],"osv":[{"id":"CVE-2022-0613","title":"Authorization Bypass Through User-Controlled Key in medialize/uri.js","description":"Authorization Bypass Through User-Controlled Key in NPM urijs prior to 1.19.8.","status":"published","published":"2022-02-16T08:40:09Z","modified":"2026-10-28T02:31:02.531146772Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T15:44:22.824781Z"},{"id":"GHSA-gcv8-gh4r-25x6","title":"Authorization Bypass Through User-Controlled Key in urijs","description":"Attacker can use case-insensitive protocol schemes like HTTP, htTP, HTtp etc. in order to bypass the patch for CVE-2021-3647.","status":"published","published":"2022-02-17T00:00:35Z","modified":"2023-11-08T04:07:37.084968Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T15:46:47.822182Z"},{"id":"RHBA-2022:1352","title":"Red Hat Bug Fix Advisory: .NET Core 3.1 on RHEL 7 bugfix update","status":"published","published":"2024-09-14T01:19:50Z","modified":"2026-10-02T10:01:34Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHBA-2022:1386","title":"Red Hat Bug Fix Advisory: .NET Core 3.1 on RHEL 8 bugfix update","status":"published","published":"2024-09-14T01:19:41Z","modified":"2026-10-02T10:01:34Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"UBUNTU-CVE-2022-0613","description":"Authorization Bypass Through User-Controlled Key in NPM urijs prior to 1.19.8.","status":"published","published":"2022-02-16T09:15:00Z","modified":"2026-10-17T12:55:55.60560963Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:53:51.630172Z"}]}}