Unangemessene Entfernung sensibler Informationen vor der Speicherung oder Übertragung in eventsource/eventsource

The vulnerability in eventsource allows an attacker to potentially expose sensitive information due to improper removal before storage or transfer. This can occur if the package is used in a context where it handles sensitive data. An attacker could craft a malicious event source that exposes sensitive data to an unauthorized actor. The potential impact includes data breaches, unauthorized access to systems, and reputational damage. The blast radius is dependent on the applications using the vulnerable eventsource package.

Applications built using Node.js that rely on the eventsource library for event streaming or long-polling functionality are at risk. This includes web applications, backend services, and any other systems integrating this library. Developers who haven't recently reviewed their dependencies are particularly vulnerable.

• nodejs / server:

  npm list eventsource

This command will list the installed version of the eventsource library. If the version is less than v2.0.2, the system is vulnerable. • nodejs / server:

npm audit eventsource

This command will check for known vulnerabilities in the eventsource library and report any findings. • generic web: Review application code for instances where the eventsource library is used. Look for potential data leakage points where sensitive information might be passed to or from the library without proper sanitization.

1. 2022-05-12Disclosure

   disclosure

1. Reserviert2022-05-10
2. Veröffentlicht2022-05-12
3. Geändert2024-08-03
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2022-1650 is to upgrade the eventsource package to version v2.0.2 or later. If upgrading is not immediately possible, carefully review all data handled by the package and ensure that sensitive information is properly sanitized and removed before storage or transfer. Implement strict input validation and sanitization to prevent attackers from injecting malicious event sources. After upgrade, confirm by testing event source handling to ensure sensitive data is properly protected.

Zuletzt aktualisiert

4.1.0vor 6 Monaten