CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
CVE-2024-57965: In axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted...
0.0
CVSS
Description
In axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted setAttribute('href',href) call. NOTE: some parties feel that the code change only addresses a warning message from a SAST tool and does not fix a vulnerability.
Classification
CVE ID: CVE-2024-57965
CVSS Base Severity: NONE
CVSS Base Score: 0.0
Affected Products
Vendor: axios
Product: axios
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.05% (probability of being exploited)
EPSS Percentile: 18.25% (scored less or equal to compared to others)
EPSS Date: 2025-02-28 (when was this score calculated)
References
https://github.com/axios/axios/issues/6351https://github.com/axios/axios/releases/tag/v1.7.8
https://github.com/axios/axios/commit/0a8d6e19da5b9899a2abafaaa06a75ee548597db
https://github.com/axios/axios/pull/6714