CVE-2022-0155 — Exposure of Private Personal Information to an Unauthorized Actor in Follow-redirects

CWE-359 — Exposure of Private Personal Information to an Unauthorized ActorCWE-3888 documents7 sources
Severity
6.5MEDIUMNVD
CISA8.6
EPSS
1.3%
top 20.23%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Follow-redirects Follow-redirectsFollow-redirects Project Follow-redirectsSiemens Sinec INS
Timeline
PublishedJan 10
Latest updateMar 3

Description

follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages4 packages

▶CVEListV5follow-redirects/follow-redirects_follow-redirectsunspecified — 1.14.7
▶NVDsiemens/sinec_ins< 1.0+1

Patches

Patch: cert-portal.siemens.com ↗Patch: github.com ↗Patch: huntr.dev ↗

🔴Vulnerability Details

4
OSV
Exposure of sensitive information in follow-redirects↗2022-01-12
▶
GHSA
Exposure of sensitive information in follow-redirects↗2022-01-12
▶
CVEList
Exposure of Private Personal Information to an Unauthorized Actor in follow-redirects/follow-redirects↗2022-01-10
▶
OSV
CVE-2022-0155: follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor↗2022-01-10
▶

📋Vendor Advisories

3
CISA
Cisco Catalyst Bidirectional Forwarding Detection Denial-of-Service Vulnerability↗2022-03-03
▶
Red Hat
follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor↗2022-01-10
▶
Debian
CVE-2022-0155: node-follow-redirects - follow-redirects is vulnerable to Exposure of Private Personal Information to an...↗2022
▶
CVE-2022-0155 — Follow-redirects vulnerability | cvebase