GHSA-7gc6-qh9x-w6h8
Withdrawn Advisory: Incorrect Authorization in cross-fetch
Withdrawn ·
At a glance
- Published
- Updated
- CVE
- CVE-2022-1365
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Description
## Withdrawn Advisory This advisory has been withdrawn because the vulnerability originates from a dependency. For more information, see the `Maintainer` comments in https://huntr.com/bounties/ab55dfdd-2a60-437a-a832-e3efe3d264ac. ## Original Description When fetching a remote url with Cookie if it get Location response header then it will follow that url and try to fetch that url with provided cookie . So cookie is leaked here to thirdparty. Ex: you try to fetch example.com with cookie and if it get redirect url to attacker.com then it fetch that redirect url with provided cookie .
Affected packages
| Package | Versions |
|---|---|
| npm · cross-fetch | introduced 3.0.0, fixed 3.1.5 |
| npm · cross-fetch | introduced 0, fixed 2.2.6 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-1365 ADVISORY
- https://github.com/lquixada/cross-fetch/pull/135 WEB
- https://github.com/lquixada/cross-fetch/commit/a3b3a9481091ddd06b8f83784ba9c4e034dc912a WEB
- https://github.com/lquixada/cross-fetch PACKAGE
- https://huntr.dev/bounties/ab55dfdd-2a60-437a-a832-e3efe3d264ac WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |