Offenlegung privater persönlicher Informationen gegenüber einem unbefugten Akteur in follow-redirects/follow-redirects
Plattform
nodejs
Komponente
follow-redirects
Behoben in
1.14.7
CVE-2022-0155 describes a vulnerability in the follow-redirects package, affecting versions up to and including 1.14.7. This vulnerability results in the Exposure of Private Personal Information to an Unauthorized Actor. The vulnerability allows attackers to potentially access sensitive data. Upgrade to version 1.14.7 to address this issue.
Auswirkungen und Angriffsszenarien
The vulnerability in follow-redirects allows an attacker to potentially expose private personal information. This can occur if the package is used in a context where it follows redirects to external or untrusted domains. An attacker could craft a malicious redirect chain that exposes sensitive data to an unauthorized actor. The potential impact includes data breaches, identity theft, and reputational damage. The blast radius is dependent on the applications using the vulnerable follow-redirects package.
Ausnutzungskontext
CVE-2022-0155 is not currently listed on KEV or EPSS. The CVSS score of 8 (High) indicates a significant risk. Public proof-of-concept (POC) exploits are not widely available. Published by the NVD on 2022-01-10.
Bedrohungsanalyse
Exploit-Status
EPSS
1.30% (80% Perzentil)
CVSS-Vektor
Was bedeuten diese Metriken?
- Attack Vector
- Netzwerk — aus der Ferne über das Internet ausnutzbar. Kein physischer oder lokaler Zugriff erforderlich.
- Attack Complexity
- Niedrig — keine besonderen Bedingungen erforderlich. Zuverlässig ausnutzbar.
- Privileges Required
- Niedrig — jedes gültige Benutzerkonto ist ausreichend.
- User Interaction
- Erforderlich — Opfer muss eine Datei öffnen, auf einen Link klicken oder eine Seite besuchen.
- Scope
- Unverändert — Auswirkung auf das anfällige Komponente beschränkt.
- Confidentiality
- Hoch — vollständiger Vertraulichkeitsverlust. Angreifer kann alle Daten lesen.
- Integrity
- Hoch — Angreifer kann beliebige Daten schreiben, ändern oder löschen.
- Availability
- Hoch — vollständiger Absturz oder Ressourcenerschöpfung. Totaler Denial of Service.
Betroffene Software
Paketinformationen
- Zuletzt aktualisiert
- 1.16.0kürzlich
Schwachstellen-Klassifikation (CWE)
Zeitleiste
- Reserviert
- Veröffentlicht
- Geändert
- EPSS aktualisiert
Mitigation und Workarounds
The primary mitigation for CVE-2022-0155 is to upgrade the follow-redirects package to version 1.14.7 or later. If upgrading is not immediately possible, carefully review all redirect chains and ensure that they only lead to trusted domains. Implement strict input validation and sanitization to prevent attackers from injecting malicious redirects. Consider using a web application firewall (WAF) to filter out suspicious redirect requests. After upgrade, confirm by testing redirect chains to ensure they are handled securely.
So behebenwird übersetzt…
Actualice la dependencia follow-redirects a la versión 1.14.7 o superior. Esto corrige la vulnerabilidad de exposición de información personal privada. Ejecute `npm install follow-redirects@latest` o `yarn upgrade follow-redirects@latest` para actualizar.
CVE-Sicherheitsnewsletter
Schwachstellenanalysen und kritische Warnungen direkt in deinen Posteingang.
Häufig gestellte Fragenwird übersetzt…
What is CVE-2022-0155 in follow-redirects?
CVE-2022-0155 is a vulnerability in the follow-redirects package that allows unauthorized actors to potentially expose private personal information by improperly handling redirects.
Am I affected by CVE-2022-0155 in follow-redirects?
Applications using versions of the follow-redirects package prior to 1.14.7 are potentially affected by this vulnerability.
How do I fix CVE-2022-0155 in follow-redirects?
Upgrade the follow-redirects package to version 1.14.7 or later to resolve this vulnerability.
Is CVE-2022-0155 being actively exploited?
As of now, there are no publicly available exploitation reports or proof-of-concept code for CVE-2022-0155.
Where can I find the official follow-redirects advisory for CVE-2022-0155?
Refer to the National Vulnerability Database (NVD) entry for CVE-2022-0155 at https://nvd.nist.gov/vuln/detail/CVE-2022-0155 for more information.
Ist dein Projekt betroffen?
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.