Offenlegung privater persönlicher Informationen gegenüber einem unbefugten Akteur in follow-redirects/follow-redirects

The vulnerability in follow-redirects allows an attacker to potentially expose private personal information. This can occur if the package is used in a context where it follows redirects to external or untrusted domains. An attacker could craft a malicious redirect chain that exposes sensitive data to an unauthorized actor. The potential impact includes data breaches, identity theft, and reputational damage. The blast radius is dependent on the applications using the vulnerable follow-redirects package.

1. Reserviert2022-01-07
2. Veröffentlicht2022-01-10
3. Geändert2024-08-02
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2022-0155 is to upgrade the follow-redirects package to version 1.14.7 or later. If upgrading is not immediately possible, carefully review all redirect chains and ensure that they only lead to trusted domains. Implement strict input validation and sanitization to prevent attackers from injecting malicious redirects. Consider using a web application firewall (WAF) to filter out suspicious redirect requests. After upgrade, confirm by testing redirect chains to ensure they are handled securely.

Zuletzt aktualisiert

1.16.0kürzlich