---
title: "CX-2022-5019"
date: "2022-09-12T07:00:00+00:00"
url: "https://checkmarx.com/zero/vulnerabilities/cx-2022-5019/"
---

# CX-2022-5019

[Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/)

No CVE assigned  **Published:** Sep 12, 2022

7.5 High Severity exposure information javascript node nodejs npm sensitive

@ @amammad  Reported by Checkmarx Zero

Details Overview

## Summary

Exposure of Sensitive Information to an Unauthorized Actor in parse-url.

## Product

parse-url version 6.0.2 and prior to 6.0.1.

## Steps to reproduce

First Assume this example

```var
parseUrl("http://[email protected]:[email protected]/path/name?foo=bar&bar=42#some-hash")
```

That returns:

```protocols:
protocol: "http"
port: null
resource: "[email protected]"
user: ""
pathname: "/[email protected]/path/name"
hash: "some-hash"
search: "foo=bar&bar=42"
href: "http://[email protected]:[email protected]/path/name?foo=bar&bar=42#some-has"
```

### Expected result:

With the same URL in the URL interface of nodejs we have following result:

```hash:
host: "google.com"
hostname: "google.com"
href: "http://firstdomain.com%40jflsdk.com:[email protected]/path/name?foo=bar&bar=42#some-hash"
origin: "http://google.com"
password: "20200"
pathname: "/path/name"
port: ""
protocol: "http:"
search: "?foo=bar&bar=42"
searchParams: URLSearchParams {}
username: "firstdomain.com%40jflsdk.com"
```

In parse-url, You can see that the resource and href have different origins but they have the same origin in the URL interface of nodejs/browser.

## Remediation

Update parse-url to 6.0.1 or 6.0.3.

## Credit

This issue was reported by @amammad through huntr.dev.

## Resources

1. [21c72ab](https://github.com/ionicabizau/parse-url/commit/21c72ab9412228eea753e2abc48f8962707b1fe3)
2. [Disclosure](https://huntr.dev/bounties/2490ef6d-5577-4714-a4dd-9608251b4226)
3. [Advisory](https://github.com/advisories/GHSA-4p35-cfcx-8653)

0  High Severity CVSS v3.1 Score

   7.5

CVSS v3.1 Vectors- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None

Advisory Timeline1. Disclosed Feb 11, 2022

## Explore more findings

[27 Nov 2025 CVE-2025-34281  Stored Cross-Site Scripting (XSS) in ThingsBoard   6.2  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825  HTTP Response Splitting in cpp-httplib   6.9  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050  Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface   4.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374  Code Injection in UltiMaker Cura   7.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497  Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496  Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [  14 Nov 2024 CVE-2024-51495  Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field   7.5  Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351  Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)