Sensitive Information Disclosure

2024-03-1715:19:39

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

sensitive information disclosure

vulnerability

go software

client

headers

http redirect

6.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

10.0%

JSON

go is vulnerable to Sensitive Information Disclosure. The vulnerability is due to the client not forwarding sensitive headers such as “Authorization” or “Cookie” when following an HTTP redirect to a domain that is not a subdomain match or exact match of the initial domain.

CPENameOperatorVersion
go:3.19eq1.21.3-r1
go:3.19eq1.21.4-r0
go:3.19eq1.21.7-r0
go:3.19eq1.21.5-r0
go:edgeeq1.19.5-r0
go:edgeeq1.18.4-r2
go:edgeeq1.20.7-r0
go:edgeeq1.19.1-r0
go:edgeeq1.18-r0
go:edgeeq1.20.1-r0

Name	Operator	Version
go:3.19	eq	1.21.3-r1
go:3.19	eq	1.21.4-r0
go:3.19	eq	1.21.7-r0
go:3.19	eq	1.21.5-r0
go:edge	eq	1.19.5-r0
go:edge	eq	1.18.4-r2
go:edge	eq	1.20.7-r0
go:edge	eq	1.19.1-r0
go:edge	eq	1.18-r0
go:edge	eq	1.20.1-r0