Vulnerability · Published Jan 10, 2022 · Assigned by @huntrdev
CVE-2022-0155Exposure of Private Personal Information to an Unauthorized Actor in follow-redirects/follow-redirects
High 8.0
In plain English
A high-severity security flaw in follow-redirects/follow-redirects from follow-redirects. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.6% (higher than 85% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.0)8.0High
Exploit odds (30 days)2.6%top 14.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | node-follow-redirects | 1.14.7+~1.13.1-1 | DEBIAN-CVE-2022-0155 |
| Debian:13 | node-follow-redirects | 1.14.7+~1.13.1-1 | DEBIAN-CVE-2022-0155 |
| Debian:14 | node-follow-redirects | 1.14.7+~1.13.1-1 | DEBIAN-CVE-2022-0155 |
| npm | follow-redirects | 1.14.7 | GHSA-74fj-2j2h-c42q |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| follow-redirects | follow-redirects/follow-redirects | unspecified – before 1.14.7 |
Weakness: CWE-359 · Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
References
- https://huntr.dev/bounties/fc524e4b-ebb6-427d-ab67-a64181020406 x_refsource_CONFIRM
- https://github.com/follow-redirects/follow-redirects/commit/8b347cbcef7c7b72a6e9be20f5710c17d6163c22 x_refsource_MISC
- https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf x_refsource_CONFIRM