---
title: "GHSA-jgrh-5m3h-9c5f: Web Cache Poisoning in find-my-way"
description: "Moderate severity. Web Cache Poisoning in find-my-way. Affects find-my-way; fixed in 3.0.5."
url: https://inlinr.com/advisories/GHSA-jgrh-5m3h-9c5f
lang: en
---

[Packages](https://inlinr.com/packages) / [find-my-way](https://inlinr.com/packages/find-my-way) / [Security](https://inlinr.com/packages/find-my-way/security)

Moderate Vulnerability GHSA-jgrh-5m3h-9c5f CVE-2020-7764 SNYK-JS-FINDMYWAY-1038269 Published 9 Nov 2020

# Web Cache Poisoning in find-my-way

Your version 

Affected releases · [find-my-way](https://inlinr.com/packages/find-my-way)

- 3.x 3.0.0 – 3.0.4 Fixed in 3.0.5
- 2.x 2.0.0 – 2.2.4 Fixed in 2.2.5
- 1.x and older 0.0.1 – 1.18.1 No fix, no longer updated

On 3.x, the newest line:

```
npm install find-my-way@3.0.5
```

Every release on a timeline

9.x 

1. Not affected

9.0.0 – 9.10.0  
12 releases, latest

3.x 

1. Affected

3.0.0 – 3.0.4  
5 releases
2. Fixed

3.0.5  
1 release

2.x 

1. Affected

2.0.0 – 2.2.4  
10 releases
2. Fixed

2.2.5  
1 release

1.x 

1. Affected

1.0.0 – 1.18.1  
42 releases

0.x 

1. Affected

0.0.1 – 0.2.4  
7 releases

121 stable releases of find-my-way, oldest to newest, one row per major.

## What happens

This affects the package find-my-way before 2.2.5, from 3.0.0 and before 3.0.5\. It accepts the Accept-Version' header by default, and if versioned routes are not being used, this could lead to a denial of service. Accept-Version can be used as an unkeyed header in a cache poisoning attack.

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: none
- **Integrity**: none
- **Availability**: high

CVSS:3.1/​AV:N/​AC:H/​PR:N/​UI:N/​S:U/​C:N/​I:N/​A:H

## References

- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-7764 "https://nvd.nist.gov/vuln/detail/CVE-2020-7764")  
nvd.nist.gov/vuln/detail/CVE-2020-7764
- [Fix commit](https://github.com/delvedor/find-my-way/commit/ab408354690e6b9cf3c4724befb3b3fa4bb90aac "https://github.com/delvedor/find-my-way/commit/ab408354690e6b9cf3c4724befb3b3fa4bb90aac")  
ab40835
- [Reference](https://snyk.io/vuln/SNYK-JS-FINDMYWAY-1038269 "https://snyk.io/vuln/SNYK-JS-FINDMYWAY-1038269")  
snyk.io/vuln/SNYK-JS-FINDMYWAY-1038269
- [Reference](https://www.npmjs.com/package/find-my-way "https://www.npmjs.com/package/find-my-way")  
npmjs.com/package/find-my-way