GHSA-jr5f-v2jv-69x6Published

Possible SSRF and Credential Leakage via Absolute URL in axios Requests

cve-program · CVE-2025-27152

Published

axios

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "axios",
                    "product": "axios",
                    "versions": [
                        {
                            "version": "< 1.8.2",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2025-7731

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Mar 7, 2025, 3:13:15 PM

dateUpdated: Mar 7, 2025, 7:32:17 PM

13 related source bulletins · separate from aliases

SUSE-SU-2025:1326-1: Security update for pgadmin4

CVE-2023-1907 · CVE-2024-4068 · CVE-2025-27152

WID-SEC-W-2025-0930: IBM Business Automation Workflow: Mehrere Schwachstellen

CVE-2024-55565 · CVE-2025-1495 · CVE-2025-1838 · CVE-2025-27152 · CVE-2025-27789

NCSC-2026-0034: Kwetsbaarheden verholpen in Atlassian producten

CVE-2021-3807 · CVE-2022-25883 · CVE-2022-45693 · CVE-2024-21538 · CVE-2024-38286 · CVE-2024-45296 · CVE-2024-45801 · CVE-2025-12383 · CVE-2025-15284 · CVE-2025-27152 · CVE-2025-41249 · CVE-2025-48976 · CVE-2025-48989 · CVE-2025-49146 · CVE-2025-52434 · CVE-2025-52999 · CVE-2025-53689 · CVE-2025-54988 · CVE-2025-55163 · CVE-2025-55752 · CVE-2025-64775 · CVE-2025-66516 · CVE-2025-9287 · CVE-2025-9288 · CVE-2026-21569

SUSE-SU-2025:1227-1: Security update for pgadmin4

CVE-2025-27152

SUSE-SU-2025:01326-1: Security update for pgadmin4

CVE-2023-1907 · CVE-2024-4068 · CVE-2025-27152

WID-SEC-W-2025-0705: HCL BigFix WebUI-Anwendungen: Mehrere Schwachstellen

CVE-2024-47764 · CVE-2025-25977 · CVE-2025-27152 · CVE-2025-27789 · CVE-2025-29774 · CVE-2025-29775

openSUSE-SU-2025:15307-1: velociraptor-0.7.0.4.git163.87ee3570-1.1 on GA media

CVE-2025-27144 · CVE-2025-27152 · CVE-2025-30204

WID-SEC-W-2025-2611: NetApp ActiveIQ Unified Manager (Axios): Schwachstelle ermöglicht Offenlegung von Informationen

CVE-2025-27152

WID-SEC-W-2025-0841: IBM App Connect Enterprise: Mehrere Schwachstellen

CVE-2024-57965 · CVE-2025-27152 · CVE-2025-29774 · CVE-2025-29775

WID-SEC-W-2026-0177: Atlassian Bamboo, Bitbucket, Confluence und Jira: Mehrere Schwachstellen

msrc_CVE-2025-27152: Possible SSRF and Credential Leakage via Absolute URL in axios Requests

CVE-2025-27152

WID-SEC-W-2025-0580: IBM License Metric Tool: Mehrere Schwachstellen

CVE-2024-10917 · CVE-2024-12797 · CVE-2024-21208 · CVE-2024-21210 · CVE-2024-21217 · CVE-2024-21235 · CVE-2024-45296 · CVE-2024-52798 · CVE-2024-57965 · CVE-2025-27111 · CVE-2025-27152 · CVE-2025-25184

WID-SEC-W-2025-0998: IBM App Connect Enterprise Certified Container: Mehrere Schwachstellen

CVE-2024-6827 · CVE-2025-1194 · CVE-2025-32996 · CVE-2025-32997 · CVE-2025-27152 · CVE-2025-27789 · CVE-2025-1993

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2025-27152

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Analyzed

Weakness classifications: CWE-918

Original publisher date fields

published: 2025-03-07T16:15:38.773

lastModified: 2026-06-17T09:03:06.570

1 source CPE criteria · context only

cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:*

The original JSON retains the logical configuration operators, exclusions and version bounds.

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-jr5f-v2jv-69x6

Published

axios

npm

SEMVER · introduced 1.0.0 → fixed 1.8.2

axios

npm

SEMVER · introduced 0 → fixed 0.30.0

Original source record · Cite this exact observation · Complete original publisher JSON