CVE-2022-247192.6LowCWE-359

CVE-2022-24719: Unauthorized forwarding of confidential headers in fluture-node

fluture-js · fluture-node

Affected: fluture-js fluture-node · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.8%probability of exploitation in the next 30 days

58th percentile

050100

Higher than 58% of scored CVEs

2.6LowCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

Fluture-Node is a FP-style HTTP and streaming utils for Node based on Fluture. Using `followRedirects` or `followRedirectsWith` with any of the redirection strategies built into fluture-node 4.0.0 or 4.0.1, paired with a request that includes confidential headers such as Authorization or Cookie, exposes you to a vulnerability where, if the destination server were to redirect the request to a server on a third-party domain, or the same domain over unencrypted HTTP, the headers would be included in the follow-up request and be exposed to the third party, or potential http traffic sniffing. The redirection strategies made available in version 4.0.2 automatically redact confidential headers when a redirect is followed across to another origin. A workaround has been identified by using a custom redirection strategy via the `followRedirectsWith` function. The custom strategy can be based on the new strategies available in fluture-node@4.0.2.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

fluture-js · fluture-node>= 4.0.0, < 4.0.2

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Exposure of Private Personal Information to an Unauthorized Actor · Information Disclosure
Published: March 2022
Band: Unlikely (under 1%), March 2022

CoverageNo articles yet

No CyberSIXT article names CVE-2022-24719 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.