CVE-2023-28155 @ Npm-request-2.88.2

[westonphillips]

Vulnerable Package issue exists @ Npm-request-2.88.2 in branch main

The request package for "Node.js" allows a bypass of Server Side Request Forgery (SSRF) mitigations via an attacker-controller server that does a Cross-Protocol Redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Namespace: westonphillips
Repository: CheckmarxOnePOV
Repository Url: https://github.com/westonphillips/CheckmarxOnePOV
CxAST-Project: westonphillips/CheckmarxOnePOV
CxAST platform scan: 6a8170d0-38fa-4efc-81df-42628474102c
Branch: main
Application: CheckmarxOnePOV
Severity: MEDIUM
State: NOT_IGNORED
Status: RECURRENT
CWE: CWE-918

---

Additional Info
Attack vector: NETWORK
Attack complexity: LOW
Confidentiality impact: LOW
Availability impact: NONE

---

References
Advisory
Issue
Pull request
Vulnerable code
Disclosure