CVE-2024-28849CWE-200

Proxy-Authorization header kept across hosts in follow-redirects

Medium · published March 14, 2024

CVSS v3.1
6.5
EPSS
1%
Percentile
63.8
In the wild
Unconfirmed
What it is

follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01044 · 63.8th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2024-03-14T17:07Z
EPSS history
Timeline
  • 14 MAR 17:07Z
    Proxy-Authorization header kept across hosts in follow-redirects
    cvelistv5