2.6 Low
CVSS3
Attack Vector
ADJACENT
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
0.001 Low
EPSS
Percentile
39.2%
Fluture-Node is a FP-style HTTP and streaming utils for Node based on Fluture. Using followRedirects
or followRedirectsWith
with any of the redirection strategies built into fluture-node 4.0.0 or 4.0.1, paired with a request that includes confidential headers such as Authorization or Cookie, exposes you to a vulnerability where, if the destination server were to redirect the request to a server on a third-party domain, or the same domain over unencrypted HTTP, the headers would be included in the follow-up request and be exposed to the third party, or potential http traffic sniffing. The redirection strategies made available in version 4.0.2 automatically redact confidential headers when a redirect is followed across to another origin. A workaround has been identified by using a custom redirection strategy via the followRedirectsWith
function. The custom strategy can be based on the new strategies available in [email protected].
[
{
"product": "fluture-node",
"vendor": "fluture-js",
"versions": [
{
"status": "affected",
"version": ">= 4.0.0, < 4.0.2"
}
]
}
]