PT-2022-7066 · Undici +7 · Undici +7

🗓️ 21 Jul 2022 00:00:00Reported by Positive TechnologiesType

ptsecurity🔗 dbugs.ptsecurity.com👁 14 Views

Undici before 5.26.2 clears Authorization on cross-origin redirects but not cookie headers, risking cookie leakage; upgrade to 5.26.2+.

Reporter	Title	Published	Views	Family All 3974
IBM Security Bulletins	Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to Node.js vulnerabilities [ CVE-2024-27982, CVE-2024-27983]	4 Feb 202519:31	–	ibm
IBM Security Bulletins	Security Bulletin: There is a vulnerability in HTTP/2 protocol used by Netty on IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2023-44487)	5 Apr 202415:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to security restrictions bypass due to [CVE-2023-38552], [CVE-2023-39333]	14 Dec 202310:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ is vulnerable to issues in Eclipse (CVE-2023-4218, CVE-2023-44487)	29 Feb 202421:58	–	ibm
IBM Security Bulletins	Security Bulletin: Node.js vulnerabilities affect IBM Spectrum Control	8 Jul 202409:24	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Node.js	27 Sep 202321:08	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	15 Mar 202500:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager November 2023 - Multiple CVEs addressed	15 Nov 202313:37	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM WebSphere Application Server Liberty affect IBM Storage Scale System	16 Sep 202418:20	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics is affected by multiple vulnerabilities	15 Apr 202503:05	–	ibm

Source	Link
github	www.github.com/bcdannyboy/CVE-2023-44487
github	www.github.com/imabee101/CVE-2023-44487
github	www.github.com/studiogangster/CVE-2023-44487
github	www.github.com/nxenon/cve-2023-44487
github	www.github.com/lirantal/CVE-2024-27983-nodejs-http2
github	www.github.com/nodejs/undici/security/advisories/GHSA-wqq4-5wpv-mx2g
github	www.github.com/nodejs/undici/commit/e041de359221ebeae04c469e8aff4145764e6d76
safe-surf	www.safe-surf.ru/specialists/bulletins-nkcki/704884
errata	www.errata.rockylinux.org/RLSA-2023:7205
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-31151

13 Feb 2025 00:00Current

6.4Medium risk

Vulners AI Score6.4

CVSS 24

CVSS 3.19.8

CVSS 38.2

EPSS0.99999

SSVC