high7.5
CVE-2022-0355
Exposure of Sensitive Information in simple-get
Impact
In versions of simple-get prior to 4.0.1, 3.1.1, and 2.8.2, when fetching a remote url with a cookie location response, headers will be followed, potentially resulting in an exposure of the session cookie to a third party.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | simple-get | = 4.0.0 | 4.0.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Simple-Get Project | Simple-Get | before 2.8.2 from 3.0.0 before 3.1.1 Version 4.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-wpg7-2c88-r8xv
- https://github.com/feross/simple-get/commit/e4af095e06cd69a9235013e8507e220a79b9684f
- https://huntr.dev/bounties/42c79c23-6646-46c4-871d-219c0d4b4e31
- https://nvd.nist.gov/vuln/detail/CVE-2022-0355
- https://github.com/feross/simple-get/pull/75#issuecomment-1027755026
- https://github.com/feross/simple-get/pull/76#issuecomment-1027754710