Description
axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios. This issue is fixed in 1.8.2.
Remediation
References
Related Vulnerabilities
WordPress Plugin Download Manager Cross-Site Scripting (3.2.42)
WordPress Plugin Bookly #1 WordPress Booking Plugin (Lite Version) Cross-Site Scripting (14.4)
WordPress Plugin AdSense Manager Cross-Site Scripting (4.0.3)
WordPress Plugin WPtouch Backdoor (1.9.28)
WordPress Plugin Catch Themes Demo Import Unspecified Vulnerability (1.8)