PT-2022-3410 · Unknown +5 · Eventsource +5

🗓️ 12 May 2022 00:00:00Reported by Positive TechnologiesType

ptsecurity

ptsecurity🔗 dbugs.ptsecurity.com👁 1 Views

Eventsource prior to 2.0.2 leaks cookies and authorization data; update to 2.0.2+.

Reporter	Title	Published	Views	Family All 146
IBM Security Bulletins	Security Bulletin: Open Source Dependency Vulnerability	15 May 202317:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Robotic Process Automation may be vulnerable to spoofing attacks due to System.Security.Cryptography.Xml (CVE-2022-34716))	29 Sep 202214:43	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Business Automation Manager Open Editions 8.0.1	26 Mar 202502:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Planning Analytics Workspace has addressed multiple vulnerabilities	27 Mar 202420:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to improper removal of sensitive information before storage or transfer in the console (CVE-2022-1650)	4 Apr 202521:15	–	ibm
IBM Security Bulletins	Security Bulletin: Mutiple vulnerabilties affecting Watson Machine Learning Accelerator on Cloud Pak for Data	12 Dec 202317:39	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability in Microsoft .NET may affect IBM Robotic Process Automation allowing an attacker to conduct spoofing attacks (CVE-2022-34716)	11 Sep 202316:03	–	ibm
IBM Security Bulletins	Security Bulletin: NPM GitHub EventSource improper removal of sensitive information (CVE-2022-1650)	1 Nov 202319:39	–	ibm
ALT Linux	Security fix for the ALT Linux 10 package dotnet-runtime-7.0 version 6.0.12-alt1	27 Dec 202200:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package dotnet-coreclr-3.1 version 3.1.32-alt1	18 Mar 202300:00	–	altlinux

Source	Link
huntr	www.huntr.dev/bounties/dc9e467f-be5d-4945-867d-1044d27e9b8e
github	www.github.com/eventsource/eventsource/commit/10ee0c4881a6ba2fe65ec18ed195ac35889583c4
osv	www.osv.dev/vulnerability/USN-6082-1
osv	www.osv.dev/vulnerability/RLSA-2022:6057
bdu	www.bdu.fstec.ru/vul/2022-04184
security-tracker	www.security-tracker.debian.org/tracker/source-package/node-eventsource
bdu	www.bdu.fstec.ru/vul/2023-06583
cve	www.cve.org/CVERecord
security-tracker	www.security-tracker.debian.org/tracker/CVE-2022-1650
ubuntu	www.ubuntu.com/security/CVE-2022-1650

02 Aug 2023 00:00Current

6.7Medium risk

Vulners AI Score6.7

CVSS 25.8 - 9.4

CVSS 3.18.1 - 9.3

EPSS0.01666

SSVC

eventsource prior versions cookies exposed authorization headers external sites same origin policy version 2.0.2 data leakage