First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2022-1233

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

URL Confusion When Scheme Not Supplied in GitHub repository medialize/uri.js prior to 1.19.11.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-115 CWE-601

Affected software

Vendor	Product	Versions
medialize	medialize/uri.js	>= unspecified, < 1.19.11

References

https://github.com/medialize/uri.js/commit/88805fd3da03bd7a5e60947adb49d182011f1277Patch, Third Party Advisory
https://huntr.dev/bounties/228d5548-1109-49f8-8aee-91038e88371cExploit, Third Party Advisory
https://github.com/medialize/uri.js/commit/88805fd3da03bd7a5e60947adb49d182011f1277Patch, Third Party Advisory
https://huntr.dev/bounties/228d5548-1109-49f8-8aee-91038e88371cExploit, Third Party Advisory

Timeline

Published: Apr 4, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-12346.1XSS in livehelperchat in GitHub repository livehelperchat/livehelperchat prior to 3.97. This vulnerability has the potential to deface websi CVE-2022-12358.2Weak secrethash can be brute-forced in GitHub repository livehelperchat/livehelperchat prior to 3.96.CVE-2022-12366.5Weak Password Requirements in GitHub repository weseek/growi prior to v5.0.0.CVE-2022-12377.8Improper Validation of Array Index in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is heap overflow and may be exp CVE-2022-12387.8Out-of-bounds Write in libr/bin/format/ne/ne.c in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is heap overflow an CVE-2022-12398.8The HubSpot WordPress plugin before 8.8.15 does not validate the proxy URL given to the proxy REST endpoint, which could allow users with th CVE-2022-12407.8Heap buffer overflow in libr/bin/format/mach0/mach0.c in GitHub repository radareorg/radare2 prior to 5.8.6. If address sanitizer is disable CVE-2022-12416.1The Ask me WordPress theme before 6.8.2 does not properly sanitise and escape several of the fields in the Edit Profile page, leading to Ref CVE-2022-12427.8Apport can be tricked into connecting to arbitrary sockets as the root user CVE-2022-12436.1CRHTLF can lead to invalid protocol extraction potentially leading to XSS in GitHub repository medialize/uri.js prior to 1.19.11.CVE-2022-12445.5heap-buffer-overflow in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of inducing denial of service.CVE-2022-12459.8A privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client application holding a