What is CVE-2024-28607?

CVE-2024-28607 is a low-severity vulnerability in Librasean Ip-utils, classified under CWE-180. CVSS score: 2.9/10. Published 2025-03-11.

How severe is CVE-2024-28607?

Low severity. CVSS v3 base score is 2.9 out of 10.

Vulnerability in Librasean Ip-utils

CVE-2024-28607

The ip-utils package through 2.4.0 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via a falsy isPrivate return value.

EPSS: 0.001 (28.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 2.9 (Low). Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N.

Affected products

Librasean Ip-utils — versions 0

Weakness classification (CWE)

CWE-180

References

github.com/librasean/IP-Utils/blob/4f88799f94f21efe6ea9135129ab2bbeb0c58edc/src…
gist.github.com/aydinnyunus/4d71e7d9a433f3afc658724b903f4d23

Frequently asked questions

What is CVE-2024-28607?: CVE-2024-28607 is a low-severity vulnerability in Librasean Ip-utils, classified under CWE-180. CVSS score: 2.9/10. Published 2025-03-11.
How severe is CVE-2024-28607?: Low severity. CVSS v3 base score is 2.9 out of 10.