GitHub Advisoryadvisory · npm

GHSA-pw2r-vq6v-hr8c Exposure of Sensitive Information to an Unauthorized Actor in follow-redirects

MEDIUM Published 2022-02-10 Modified 2022-02-14 Official page ↗
Aliases
CVE-2022-0536
Ecosystem
npm
Packages
follow-redirects
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200, CWE-212
Reviewed
2022-02-11

Affected packages

• npm follow-redirects: < 1.14.8 → fixed in 1.14.8

Description

Exposure of Sensitive Information to an Unauthorized Actor in NPM follow-redirects prior to 1.14.8.

Related

Alias · CVE (1)

  • CVE-2022-0536 Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8. vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer weakness

References