{"id":"CVE-2024-29415","published":"2024-05-27T20:04:14Z","modified":"2025-02-13T15:47:46Z","title":"The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567…","vendor":null,"product":null,"tier":"tail","description":{"text":"The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.08279,"percentile":0.94896,"provenance":"source"},"cwes":[{"id":"CWE-918","name":"Server-Side Request Forgery"},{"id":"CWE-941","name":"Incorrectly Specified Destination in a Communication Channel"}],"references":[{"url":"https://github.com/indutny/node-ip/pull/143","tags":[]},{"url":"https://github.com/indutny/node-ip/pull/144","tags":[]},{"url":"https://github.com/indutny/node-ip/issues/150","tags":[]},{"url":"https://security.netapp.com/advisory/ntap-20250117-0010/","tags":[]}],"priority":{"score":29.6,"factors":[{"name":"EPSS percentile","points":18.98},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":5.67}]},"exploitSources":{"pocGithub":{"count":2,"skipped":0,"earliest":"2024-07-05","earliestUrl":"https://github.com/felipecruz91/node-ip-vex","repos":[{"name":"felipecruz91/node-ip-vex","url":"https://github.com/felipecruz91/node-ip-vex","stars":1,"created":"2024-07-05"},{"name":"bybraveHQ/ip2","url":"https://github.com/bybraveHQ/ip2","stars":0,"created":"2026-07-04"}]},"first":{"date":"2024-07-05","source":"PoC-in-GitHub","url":"https://github.com/felipecruz91/node-ip-vex"},"provenance":"source"},"affected":[{"ecosystem":"npm","package":"ip","vulnerableRanges":["<=2.0.1"],"patched":[],"from":["GHSA-2p57-rm9w-gvfp"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-1886","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-fedorindutny-ip-cve-2023-42282","parents":[{"from":"CVE-2023-42282","to":"CVE-2024-29415","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.","from":"CVE.org","in":"CVE-2024-29415"},{"kind":"similar","provenance":"machine","score":0.86,"basis":"same package + description similarity"}]}],"children":[{"from":"CVE-2024-29415","to":"CVE-2025-59436","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this issue exists because of an incomplete fix for CVE-2024-29415.","from":"CVE.org","in":"CVE-2025-59436"}]},{"from":"CVE-2024-29415","to":"CVE-2025-59437","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this issue exists because of an incomplete fix for CVE-2024-29415.","from":"CVE.org","in":"CVE-2025-59437"}]}]}}