{"id":"GHSA-g694-m8vq-gv9h","summary":"URL Confusion When Scheme Not Supplied in medialize/uri.js","details":"Medialize is a Javascript URL mutation library. When parsing a URL without a scheme and with excessive slashes, like ///www.example.com, URI.js will parse the hostname as null and the path as /www.example.com. Such behaviour is different from that exhibited by browsers, which will parse ///www.example.com as http://www.example.com instead. For example, the following will cause a redirect to http://www.example.com: A fix was released in version 1.19.11.","aliases":["CVE-2022-1233"],"modified":"2023-11-01T04:57:19.546596Z","published":"2022-04-05T00:00:17Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2022-04-05T18:34:38Z","nvd_published_at":"2022-04-04T20:15:00Z","cwe_ids":["CWE-115","CWE-601"]},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1233"},{"type":"WEB","url":"https://github.com/medialize/uri.js/commit/88805fd3da03bd7a5e60947adb49d182011f1277"},{"type":"PACKAGE","url":"https://github.com/medialize/uri.js"},{"type":"WEB","url":"https://huntr.dev/bounties/228d5548-1109-49f8-8aee-91038e88371c"}],"affected":[{"package":{"name":"urijs","ecosystem":"npm","purl":"pkg:npm/urijs"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.19.11"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-g694-m8vq-gv9h/GHSA-g694-m8vq-gv9h.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}]}