Exposure of sensitive information in follow-redirects

Description

follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor

Recommendation

Update the follow-redirects package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.14.7
• Patched version(s): 1.14.7

References

• GHSA-74fj-2j2h-c42q
• huntr.dev
• cert-portal.siemens.com
• CVE-2022-0155
• CWE-359
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Exposure of Sensitive Information to an Unauthorized Actor in follow-redirects - CVE-2022-0536
• Exposure of Sensitive Information in simple-get - CVE-2022-0355
• Exposure of Sensitive Information in eventsource - CVE-2022-1650
• Converse.js Exposure of Sensitive Information - CVE-2018-6591

Tags:

npm

follow-redirects