Description
When fetching an url with a link to an external site (Redirect), the users Cookies & Autorisation headers are leaked to the third party application. According to the same-origin-policy, the header should be “sanitized.
Recommendation
Update the eventsource package to the latest compatible version. Followings are version details:
Affected version(s): **>= 2.0.0, < 2.0.2 < 1.1.1** Patched version(s): **2.0.2 1.1.1**
References
Could your website be exposed too?
SmartScanner can check your website for Exposure of Sensitive Information in eventsource and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Exposure of Sensitive Information in simple-get - CVE-2022-0355
- Exposure of Sensitive Information to an Unauthorized Actor in nanoid - CVE-2021-23566
- Improper Removal of Sensitive Information Before Storage or Transfer in Strapi - CVE-2022-30618
- Improper Removal of Sensitive Information Before Storage or Transfer in Strapi - @strapi/strapi - CVE-2022-30617
You might also like:
See something that needs correcting? Let us knowUpdated November 28, 2023