https://github.com/nodejs/undici
En bref
- Source
- NVD
- EPSS
- EPSS 0.47 % · centile 40 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- hackerone
- Statut NVD
- Modified
Description
`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally HTTPS requests are actually sent via plain-text HTTP between Undici and the proxy server.
Faiblesses (CWE)
- CWE-295 — Validation incorrecte de certificat
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-pgw7-wx7w-2w33 — ProxyAgent vulnerable to MITM
Références européennes
- ENISA EUVD · EUVD-2022-6112
- GCVE · GCVE-0-2022-32210
Configurations affectées (CPE NVD)
cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:*≥ 4.8.2 < 5.5.1
Produits affectés
| Produit | Versions |
|---|---|
| https://github.com/nodejs/undici | affected Fixed in version >= v5.5.1. Vulnerable between v4.8.2 and v5.5.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |