CVE-2022-0155

Опубликовано: 10 янв. 2022

Источник: redhat

CVSS3: 6.5

EPSS Низкий

Описание

follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor

A flaw was found in follow-redirects when fetching a remote URL with a cookie when it gets to the Location response header. This flaw allows an attacker to hijack the account as the cookie is leaked.

Затронутые пакеты

Платформа	Пакет	Состояние	Рекомендация	Релиз
OpenShift Service Mesh 1	npm-follow-redirects	Out of support scope
OpenShift Service Mesh 2.0	npm-follow-redirects	Will not fix
Red Hat Advanced Cluster Management for Kubernetes 2	rhacm2/console-header-rhel8	Will not fix
Red Hat Advanced Cluster Management for Kubernetes 2	rhacm2/mcm-topology-rhel8	Will not fix
Red Hat Advanced Cluster Security 3	follow-redirects	Affected
Red Hat Advanced Cluster Management for Kubernetes 2	acmesolver-container	Fixed	RHSA-2022:0856	14.03.2022
Red Hat Advanced Cluster Management for Kubernetes 2	acm-must-gather-container	Fixed	RHSA-2022:0856	14.03.2022
Red Hat Advanced Cluster Management for Kubernetes 2	acm-operator-bundle-container	Fixed	RHSA-2022:0856	14.03.2022
Red Hat Advanced Cluster Management for Kubernetes 2	application-ui-container	Fixed	RHSA-2022:0856	14.03.2022
Red Hat Advanced Cluster Management for Kubernetes 2	cainjector-container	Fixed	RHSA-2022:0856	14.03.2022

Показывать по

Ссылки на источники

Дополнительная информация

Статус:

Moderate

Дефект:

CWE-359

https://bugzilla.redhat.com/show_bug.cgi?id=2044556follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor

EPSS

Процентиль: 74%

0.00857

Низкий

6.5 Medium

CVSS3

Связанные уязвимости

CVE-2022-0155

CVSS3: 6.5

ubuntu

больше 3 лет назад

follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor

CVE-2022-0155

CVSS3: 6.5

nvd

больше 3 лет назад

follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor

CVE-2022-0155

CVSS3: 6.5

debian

больше 3 лет назад

follow-redirects is vulnerable to Exposure of Private Personal Informa ...

GHSA-74fj-2j2h-c42q

CVSS3: 8

github

больше 3 лет назад

Exposure of sensitive information in follow-redirects

BDU:2022-02815

CVSS3: 8

fstec

больше 3 лет назад

Уязвимость модуля Node.js follow-redirects, связанная с ошибками обработки файлов cookie, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

EPSS

Процентиль: 74%

0.00857

Низкий

6.5 Medium

CVSS3