Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
veracodeVeracode Vulnerability DatabaseVERACODE:43806
HistoryOct 13, 2023 - 4:59 a.m.

Cross-Origin Cookie Leakage

2023-10-1304:59:40
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
3
undici
vulnerability
cross-origin
cookie leakage
failure
clear
headers
accidental
leakage
3rd-party
site
malicious
attacker
redirection
control
software

3.9 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L

6.4 Medium

AI Score

Confidence

Low

JSON

Undici is vulnerable to Cross-Origin Cookie Leakage. The vulnerability is due to a failure to clear cookie headers which may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target.

References

Related

prion 1
ibm 8
cbl_mariner 1
cve 1
ubuntucve 1
cvelist 1
nessus 25
hackerone 1
debiancve 1
github 1
nvd 1
alpinelinux 1
redhatcve 1
osv 7
oraclelinux 3
redhat 3
openvas 11
fedora 6
almalinux 3
mageia 1
rocky 1
oracle 1
prion
prion
Authorization
2023-10-12 17:15:00
ibm
ibm
Security Bulletin: IBM Decision Optimization for Cloud Pak for Data is vulnerable to a remote authenticated attacker (CVE-2023-45143)
2024-03-08 16:54:11
Security Bulletin: IBM App Connect Enterprise is vulnerable to a remote authenticated attacker due to the electron module (CVE-2023-45143)
2024-01-17 16:30:49
Security Bulletin: Multiple vulnerabilities in IBM SDK for Node.js and packaged modules affect IBM Business Automation Workflow Configuration Editor
2024-01-17 07:30:23
cbl_mariner
cbl_mariner
CVE-2023-45143 affecting package nodejs18 for versions less than 18.18.2-2
2023-11-08 02:07:28
cve
cve
CVE-2023-45143
2023-10-12 17:15:10
ubuntucve
ubuntucve
CVE-2023-45143
2023-10-12 00:00:00
cvelist
cvelist
CVE-2023-45143 Undici's cookie header not cleared on cross-origin redirect in fetch
2023-10-12 16:35:40
nessus
nessus
RHEL 8 : node-undici (Unpatched Vulnerability)
2024-05-11 00:00:00
RHEL 9 : node-undici (Unpatched Vulnerability)
2024-05-11 00:00:00
Amazon Linux 2023 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2023-2023-412)
2023-11-04 00:00:00
hackerone
hackerone
Internet Bug Bounty: Cookie headers are not cleared in cross-domain redirect in undici-fetch
2023-11-07 15:47:49
debiancve
debiancve
CVE-2023-45143
2023-10-12 17:15:10
github
github
Undici's cookie header not cleared on cross-origin redirect in fetch
2023-10-16 14:05:37
nvd
nvd
CVE-2023-45143
2023-10-12 17:15:10
alpinelinux
alpinelinux
CVE-2023-45143
2023-10-12 17:15:10
redhatcve
redhatcve
CVE-2023-45143
2023-10-13 22:52:18
osv
osv
Undici's cookie header not cleared on cross-origin redirect in fetch
2023-10-16 14:05:37
CVE-2023-45143
2023-10-12 17:15:10
undici before v5.8.0 vulnerable to uncleared cookies on cross-host / cross-origin redirect
2022-07-21 20:31:05
oraclelinux
oraclelinux
18 security update
2023-10-20 00:00:00
nodejs:18 security update
2023-10-23 00:00:00
nodejs:20 security update
2023-11-22 00:00:00
redhat
redhat
(RHSA-2023:5869) Important: nodejs:18 security update
2023-10-18 22:01:20
(RHSA-2023:5849) Important: nodejs:18 security update
2023-10-18 15:11:16
(RHSA-2023:7205) Important: nodejs:20 security update
2023-11-14 16:23:42
openvas
openvas
Fedora: Security Advisory for nodejs18 (FEDORA-2023-dbe64661af)
2023-11-05 00:00:00
SUSE: Security Advisory (SUSE-SU-2023:4207-1)
2023-10-27 00:00:00
Mageia: Security Advisory (MGASA-2023-0299)
2023-10-23 00:00:00
fedora
fedora
[SECURITY] Fedora 38 Update: nodejs18-18.18.2-1.fc38
2023-10-24 01:23:42
[SECURITY] Fedora 37 Update: nodejs18-18.18.2-1.fc37
2023-10-26 01:35:04
[SECURITY] Fedora 39 Update: nodejs18-18.18.2-1.fc39
2023-11-03 18:59:17
almalinux
almalinux
Important: nodejs:18 security update
2023-10-18 00:00:00
Important: nodejs:18 security update
2023-10-18 00:00:00
Important: nodejs:20 security update
2023-11-14 00:00:00
mageia
mageia
Updated nodejs packages fix security vulnerabilities
2023-10-23 00:04:51
rocky
rocky
nodejs:20 security update
2023-11-28 22:43:02
oracle
oracle
Oracle Critical Patch Update Advisory - January 2024
2024-01-16 00:00:00

3.9 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L

6.4 Medium

AI Score

Confidence

Low

JSON
Related for VERACODE:43806
prion1ibm8cbl_mariner1cve1ubuntucve1cvelist1nessus25hackerone1debiancve1github1nvd1alpinelinux1redhatcve1osv7oraclelinux3redhat3openvas11fedora6almalinux3mageia1rocky1oracle1