CVE-2018-3743 Open Redirect in hekto
An open redirect vulnerability in the hekto npm library allows attackers to redirect users to malicious sites when specific filenames are used.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-3743?
CVE-2018-3743 is a medium-severity vulnerability in HackerOne hekto, published on 1 Jun 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Open redirect in hekto <=0.2.3 when target domain name is used as html filename on server.
Weakness: CWE-601
Which versions are affected by CVE-2018-3743?
2 open source packages ship an affected version, including hekto. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
hekto npm | All versions | 0.2.4 |
hekto npm | All versions | 0.2.4 |
Products include Hekto Project Hekto.
How do I fix CVE-2018-3743?
Upgrade hekto to 0.2.4 or later.
Is CVE-2018-3743 being exploited?
There is no known exploitation of CVE-2018-3743 in the wild and no public exploit code.
Other vulnerabilities in HackerOne hekto
Sources
Also known as GHSA-qmm9-x5gr-4gfm.