CVE-2022-32210CWE-295

`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy

published July 14, 2022

CVSS
—
EPSS
0%
Percentile
39.4
In the wild
Unconfirmed
What it is

`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally HTTPS requests are actually sent via plain-text HTTP between Undici and the proxy server.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00466 · 39.4th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2022-07-14T14:51Z
EPSS history
Timeline
  • 14 JUL 14:51Z
    `Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy
    cvelistv5