Maple Labs

CVE search · CVE-2022-31151

CVE-2022-31151

medium 6.5

Authorization headers are cleared on cross-origin redirect. However, cookie headers which are sensitive headers and are official headers found in the spec, remain uncleared. There are active users using cookie headers in undici. This may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd party site. This was patched in v5.7.1. By default, this vulnerability is not exploitable. Do not enable redirections, i.e. `maxRedirections: 0` (the default).

Open in the NVD CVE.org JSON

Details

Status
Modified
Published
Last changed
Source
security-advisories@github.com
Weakness
CWE-601, CWE-346

Severity

VersionScoreVectorSource
CVSS 3.1 low 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N security-advisories@github.comSecondary
CVSS 3.1 medium 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N nvd@nist.govPrimary

Affected products

Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.

References