CVE-2022-0155

🗓️ 10 Jan 2022 19:30:10Reported by @huntrdevType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 233 Views🌐 WEB

follow-redirects vulnerable to Private Personal Information Exposur

Reporter	Title	Published	Views	Family All 92
IBM Security Bulletins	Security Bulletin: IBM i Modernization Engine for Lifecycle Integration is vulnerable to multiple vulnerabilities	16 May 202420:23	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Node.js affect IBM App Connect Enterprise & IBM Integration Bus (CVE-2022-0155 & CVE-2022-0536)	12 May 202215:35	–	ibm
IBM Security Bulletins	Security Bulletin: Mutiple Vulnerabilties in Open Source packages affects IBM Watson Machine Learning Accelerator on Cloud Pak for Data	6 Dec 202316:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ Appliance is affected by follow-redirects vulnerabilities (CVE-2022-0155 and CVE-2022-0536)	14 Jul 202215:02	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for April 2022	29 Apr 202210:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to Node.js follow-redirects module information disclosure vulnerabilities (CVE-2022-0536, CVE-2022-0155)	7 Feb 202321:34	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for September 2023	5 Oct 202308:42	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Assistant app for IBM QRadar SIEM includes components with multiple known vulnerabilities	9 Nov 202218:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security QRadar Analyst Workflow app for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	19 Oct 202221:11	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in software used in node.js affect Cloud Pak System	31 Mar 202314:17	–	ibm

NVD

Node

follow-redirects_project follow-redirectsRange<1.14.7node.js

Node

siemens sinec_insRange<1.0

siemens sinec_insMatch1.0-

siemens sinec_insMatch1.0sp1

[
  {
    "product": "follow-redirects/follow-redirects",
    "vendor": "follow-redirects",
    "versions": [
      {
        "lessThan": "1.14.7",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
cert-portal	www.cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
github	www.github.com/follow-redirects/follow-redirects/commit/8b347cbcef7c7b72a6e9be20f5710c17d6163c22
huntr	www.huntr.dev/bounties/fc524e4b-ebb6-427d-ab67-a64181020406

Parameter	Position	Path	Description	CWE
url	query param	/redirect	Vulnerable follow-redirects behavior leaks cookies when following a redirect to a URL controlled by the attacker via a query parameter in the /redirect endpoint.	CWE-359