CVE-2023-45143 — Sensitive Information Exposure

Vendor	Product	Version range	Fixed in
apache	tomcat	—	—
debian	node-undici	< node-undici 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u2 (bookworm)	node-undici 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u2 (bookworm)
fedoraproject	fedora	—	—
fedoraproject	fedora	—	—
fedoraproject	fedora	—	—
msrc	cbl2_nodejs18_18.18.2-2_on_cbl_mariner_2.0	—	—
nodejs	undici	< 5.26.2	5.26.2
nodejs	undici	>= 0 < 5.26.2	5.26.2

GHSA

Undici's cookie header not cleared on cross-origin redirect in fetch

ghsa·2023-10-16

CVE-2023-45143 [LOW] CWE-200 Undici's cookie header not cleared on cross-origin redirect in fetch Undici's cookie header not cleared on cross-origin redirect in fetch ### Impact Undici clears Authorization headers on cross-origin redirects, but does not clear `Cookie` headers. By design, `cookie` headers are [forbidden request headers](https://fetch.spec.whatwg.org/#forbidden-request-header), disallowing them to be set in `RequestInit.headers` in browser environments. Since Undici handles headers more liberally than the specification, there was a disconnect from the assumptions the spec made, and Undici's implementation of fetch. As such this may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd party site. ### Patches This was patched in [e041de359221ebeae0

OSV

Undici's cookie header not cleared on cross-origin redirect in fetch

osv·2023-10-16

CVE-2023-45143 [LOW] Undici's cookie header not cleared on cross-origin redirect in fetch Undici's cookie header not cleared on cross-origin redirect in fetch ### Impact Undici clears Authorization headers on cross-origin redirects, but does not clear `Cookie` headers. By design, `cookie` headers are [forbidden request headers](https://fetch.spec.whatwg.org/#forbidden-request-header), disallowing them to be set in `RequestInit.headers` in browser environments. Since Undici handles headers more liberally than the specification, there was a disconnect from the assumptions the spec made, and Undici's implementation of fetch. As such this may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd party site. ### Patches This was patched in [e041de359221ebeae0

OSV

CVE-2023-45143: Undici is an HTTP/1

osv·2023-10-12·CVSS 3.5

CVE-2023-45143 [LOW] CVE-2023-45143: Undici is an HTTP/1 Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Cookie` headers. By design, `cookie` headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since undici handles headers more liberally than the spec, there was a disconnect from the assumptions the spec made, and undici's implementation of fetch. As such this may lead to accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version 5.26.2. There are no known workarounds.

CISA ICS

Siemens SINEC INS

cisa_ics·2024-11-14

Siemens SINEC INS ICS Advisory ## Siemens SINEC INS Release DateNovember 14, 2024 Alert CodeICSA-24-319-08 Related topics: Industrial Control System Vulnerabilities, Industrial Control Systems As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF ## 1. EXECUTIVE SUMMARY - CVSS v3 9.9 - ATTENTION: Exploitable remotely/low attack complexity/public exploits are available/known public exploitation - Vendor: Siemens - Equipment: SINEC INS - Vulnerabilities: Improper Authentication, Out-of-bounds Write, Ineffici

Red Hat

node-undici: cookie leakage

vendor_redhat·2023-10-12·CVSS 3.9

CVE-2023-45143 [LOW] CWE-200 node-undici: cookie leakage node-undici: cookie leakage Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Cookie` headers. By design, `cookie` headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since undici handles headers more liberally than the spec, there was a disconnect from the assumptions the spec made, and undici's implementation of fetch. As such this may lead to accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version 5.26.2. There are no known workarounds. A flaw w

Microsoft

Undici's cookie header not cleared on cross-origin redirect in fetch

vendor_msrc·2023-10-10·CVSS 3.5

CVE-2023-45143 [LOW] CWE-200 Undici's cookie header not cleared on cross-origin redirect in fetch Undici's cookie header not cleared on cross-origin redirect in fetch FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this. Mariner: Mariner GitHub_M: GitHub_M Customer Action Required: Yes Remediation: CBL-Mariner Releases Refer

Oracle

Oracle Oracle Commerce Risk Matrix: Endeca Application Controller (Apache Tomcat) — CVE-2022-45143

vendor_oracle·2023-07-15·CVSS 7.5

CVE-2022-45143 [HIGH] Oracle Oracle Commerce Risk Matrix: Endeca Application Controller (Apache Tomcat) — CVE-2022-45143 Oracle Oracle Commerce Risk Matrix: Endeca Application Controller (Apache Tomcat) vulnerability CVE: CVE-2022-45143 CVSS: 7.5 Protocol: HTTP Remote exploit: Yes Affected versions: Network Advisory: cpujul2023 (JUL 2023)

Oracle

Oracle Oracle Commerce Risk Matrix: Content Acquisition System, Workbench (Apache Tomcat) — CVE-2022-45143

vendor_oracle·2023-04-15·CVSS 7.5

CVE-2022-45143 [HIGH] Oracle Oracle Commerce Risk Matrix: Content Acquisition System, Workbench (Apache Tomcat) — CVE-2022-45143 Oracle Oracle Commerce Risk Matrix: Content Acquisition System, Workbench (Apache Tomcat) vulnerability CVE: CVE-2022-45143 CVSS: 7.5 Protocol: HTTP Remote exploit: Yes Affected versions: Network Advisory: cpuapr2023 (APR 2023)

Debian

CVE-2023-45143: node-undici - Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version ...

vendor_debian·2023·CVSS 3.9

CVE-2023-45143 [LOW] CVE-2023-45143: node-undici - Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version ... Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Cookie` headers. By design, `cookie` headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since undici handles headers more liberally than the spec, there was a disconnect from the assumptions the spec made, and undici's implementation of fetch. As such this may lead to accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version 5.26.2. There are no known workarounds. Scope: local bookworm: resolved (fixed

Apache

Apache tomcat: CVE-2022-45143

vendor_apache·CVSS 7.5

CVE-2022-45143 [HIGH] Apache tomcat: CVE-2022-45143 Apache tomcat: CVE-2022-45143 The JsonErrorReportValve did not escape the type , message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output. This was fixed with commit 0cab3a56 . This issue was identified by the Apache Tomcat Security team on 2 September 2022. The issue was made public on 3 January 2023. Affects: 8.5.83 2022-10-11 Fixed in Apache Tomcat 8.5.83 Low: Apache Tomcat request smuggling

CVE-2023-45143: Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects…

Affected

CVSS provenance