GitHub Advisoryadvisory · npm

GHSA-6h5x-7c5m-7cr7 Exposure of Sensitive Information in eventsource

CRITICAL Published 2022-05-13 Modified 2022-05-25 Official page ↗
Aliases
CVE-2022-1650
Ecosystem
npm
Packages
eventsource
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weaknesses
CWE-200, CWE-212
Reviewed
2022-05-25

Affected packages

• npm eventsource: < 1.1.1 → fixed in 1.1.1 • npm eventsource: >= 2.0.0, < 2.0.2 → fixed in 2.0.2

Description

When fetching an url with a link to an external site (Redirect), the users Cookies & Autorisation headers are leaked to the third party application. According to the same-origin-policy, the header should be "sanitized."

Related

Alias · CVE (1)

  • CVE-2022-1650 Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository eventsource/eventsource prior to v2.0.2. vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer weakness

References