Is CVE-2022-0722 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-0722 being exploited in the wild.

How severe is CVE-2022-0722?

Low severity, with a CVSS score of 3.1, published 28 June 2022.

Which products and versions are affected?

parse-url (npm) SEMVER:introduced=0,fixed=6.0.1.

Is there a fix for CVE-2022-0722?

Yes. parse-url (npm): upgrade to 6.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-0722 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2022-0722?

Check whether you run parse-url (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-0722: parse-url hostname confusion information disclosure

CVE-2022-0722 · Severity: low · CVSS 3.1 · Published 2022-06-28

parse-url is a widely-used JavaScript library for parsing and extracting components from URLs. A hostname confusion flaw in versions prior to 6.0.1 allows an attacker to craft malicious URLs that trick the parser into misidentifying the hostname, potentially exposing sensitive data like credentials embedded in URLs. This could compromise applications that rely on hostname validation for access control or security decisions.

Technologies: parse-url (npm). Vendors: npm.

Quick answers

Is CVE-2022-0722 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-0722 being exploited in the wild.
How severe is CVE-2022-0722?: Low severity, with a CVSS score of 3.1, published 28 June 2022.
Which products and versions are affected?: parse-url (npm) SEMVER:introduced=0,fixed=6.0.1.
Is there a fix for CVE-2022-0722?: Yes. parse-url (npm): upgrade to 6.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-0722 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2022-0722?: Check whether you run parse-url (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

parse-url (npm): upgrade to 6.0.1 or later
```
npm install parse-url@6.0.1
```

Technical details

This vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and involves a hostname confusion issue in the parse-url library. The root cause stems from improper URL parsing logic that fails to correctly distinguish between the actual hostname and other URL components in certain edge cases. The vulnerability is remotely exploitable without authentication or user interaction—an attacker can supply a crafted URL to an application using the vulnerable parse-url library. By exploiting the confusion, an attacker can cause the library to misidentify the hostname, potentially allowing sensitive information embedded in the URL (such as credentials) to be mishandled or exposed. The vulnerability affects all versions prior to 6.0.1, which includes a fix addressing the hostname parsing logic. No active exploitation in the wild has been reported.

Affected products

IonicaBizau parse-url prior to 6.0.1

Identifiers

CVE-2022-0722
GHSA-4p35-cfcx-8653

Timeline

2022-06-27: disclosed: Vulnerability published on NVD
2022-06-27: patched: Fix released in version 6.0.1
2022-06-28: advisory: GHSA-4p35-cfcx-8653 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.